CVE-2026-22574 Fortinet CVE debrief

Who should care

Defenders responsible for Fortinet FortiSOAR deployments should assess exposure and prioritize securing LDAP configurations and password storage practices. This includes reviewing and updating affected FortiSOAR versions, verifying and securing LDAP configurations, and ensuring strong password storage and authentication practices to protect Service account passwords.

Why it matters

CVE-2026-22574 storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR allows an authenticated remote attacker to retrieve Service account passwords. Defenders should prioritize verifying and securing LDAP configurations, ensuring strong password storage and authentication practices.

• Verify and secure LDAP configurations to prevent unauthorized access
• Ensure strong password storage and authentication practices to protect Service account passwords
• Review and update affected FortiSOAR versions to prevent exploitation

Technical summary

The vulnerability exists in Fortinet FortiSOAR PaaS and on-premise versions, allowing an authenticated remote attacker to retrieve Service account passwords by modifying the server address in LDAP configuration. Affected versions include Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, 7.5.0 through 7.5.2, and all versions of 7.4 and 7.3 for both PaaS and on-premise. The vulnerability is due to storing passwords in a recoverable format, which enables an attacker with authenticated access to exploit this weakness. Defenders should prioritize verifying and securing LDAP configurations, ensuring strong password storage and authentication practices.

Defensive priority

Defenders should prioritize verifying and securing LDAP configurations, ensuring strong password storage and authentication practices.

Recommended defensive actions

• Verify and secure LDAP configurations
• Ensure strong password storage and authentication practices
• Review and update affected FortiSOAR versions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability allows an authenticated remote attacker to retrieve Service account passwords by modifying the server address in LDAP configuration. Affected versions include Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, 7.5.0 through 7.5.2, and all versions of 7.4 and 7.3 for both PaaS and on-premise.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.