CVE-2026-22155 Fortinet CVE debrief

Who should care

Security teams and administrators responsible for Fortinet FortiSOAR PaaS and on-premise deployments should prioritize patching this vulnerability to prevent potential information disclosure. This includes teams managing Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, and FortiSOAR on-premise 7.3 all versions.

Technical summary

The vulnerability, tracked as CVE-2026-22155, is caused by the cleartext transmission of sensitive information in Fortinet FortiSOAR PaaS and on-premise versions. An attacker could exploit this vulnerability to gain unauthorized access to sensitive information. The CVSS score for this vulnerability is 6.5, indicating a medium severity level. Affected versions include Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, and FortiSOAR on-premise 7.3 all versions.

Defensive priority

Patching this vulnerability is a high priority due to the potential for information disclosure.

Recommended defensive actions

• Apply patches or updates provided by Fortinet to address the vulnerability
• Review and update incident response plans to account for potential exploitation
• Monitor network traffic and system logs for suspicious activity
• Implement additional security controls, such as encryption and access controls, to protect sensitive information
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-14T16:16:36.267Z and was last modified on 2026-07-08T13:16:30.430Z. The NVD entry is currently Analyzed. The cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS and on-premise versions may allow an attacker to gain unauthorized access to sensitive information. Evidence is limited to public sources and vendor advisories.

Official resources