CVE-2026-23708
CVSS Score
6.7
EPSS Score
0.0%
EPSS Percentile
0th
A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5.0 through 7.5.2 may allow an unauthenticated attacker to bypass authentication via replaying captured 2FA request. The attack requires being able to intercept and decrypt authentication traffic and precise timing to replay the request before token expiration, which raises the attack complexity.
| CWE | CWE-287 |
| Vendor | fortinet |
| Product | fortisoar paas |
| Ecosystems | |
| Industries | NetworkingSecurity |
| Published | Apr 14, 2026 |
| Last Updated | Apr 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for fortinet fortisoar paas
Be the first to know when new medium vulnerabilities affecting fortinet fortisoar paas are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Fortinet / FortiSOAR PaaS
7.6.0 ≤ 7.6.3 7.5.0 ≤ 7.5.2
Fortinet / FortiSOAR on-premise
7.6.0 ≤ 7.6.3 7.5.0 ≤ 7.5.2