CVE-2026-22154 Fortinet CVE debrief

Who should care

Defenders responsible for Fortinet FortiSOAR PaaS and on-premise deployments should assess exposure and apply patches. This includes operators, security teams, and vulnerability management teams. The vulnerability has a potential impact on confidentiality and integrity, and defenders should verify exposure and apply patches to prevent exploitation.

Why it matters

CVE-2026-22154 is a stored XSS vulnerability in Fortinet FortiSOAR PaaS and on-premise versions. Defenders should verify exposure, apply patches, and monitor for suspicious requests.

• Potential for authenticated remote attacker to perform stored XSS attack
• Possible impact on confidentiality and integrity
• Need for defenders to verify exposure and apply patches

Technical summary

The vulnerability is caused by improper neutralization of input during web page generation, allowing an authenticated remote attacker to perform a stored cross-site scripting (XSS) attack via crafted HTTP requests. The vulnerability affects Fortinet FortiSOAR PaaS and on-premise versions, including 7.6.0 through 7.6.3, 7.5.0 through 7.5.2, 7.4 all versions, and 7.3 all versions. Defenders should prioritize verifying exposure and applying patches for affected FortiSOAR versions. The vulnerability has a CVSS score of 4.6 and a severity of MEDIUM.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for affected FortiSOAR versions.

Recommended defensive actions

• Verify FortiSOAR version and check for exposure
• Apply patches for affected versions
• Monitor for suspicious HTTP requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and affected versions. Vendor advisory FG-IR-26-117 is also available. The vulnerability has been publicly disclosed and defenders should verify exposure and apply patches. The CVE record was published on 2026-04-14T16:16:36.077Z and has not been modified since then. The NVD entry provides additional information on the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.