CVE-2026-22574: Medium severity Fortinet FortiSOAR PaaS vulnerability
A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve Service account password via server address modification in LDAP configuration.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22574?
CVE-2026-22574 is classified as a high severity vulnerability due to its potential impact on password security.
How do I fix CVE-2026-22574?
To fix CVE-2026-22574, upgrade to the latest version of FortiSOAR that addresses this vulnerability.
What versions are affected by CVE-2026-22574?
CVE-2026-22574 affects FortiSOAR PaaS versions 7.6.0 to 7.6.4, 7.5.0 to 7.5.2, all versions of 7.4, and all versions of 7.3, as well as FortiSOAR on-premise in the same version ranges.
What type of vulnerability is CVE-2026-22574?
CVE-2026-22574 is a vulnerability related to storing passwords in a recoverable format.
Who is the vendor for CVE-2026-22574?
The vendor for CVE-2026-22574 is Fortinet, known for its security solutions including FortiSOAR.