CVE-2025-59809: Fortinet FortiSOAR SSRF Vulnerability

CVE-2025-59809 Overview

A Server-Side Request Forgery (SSRF) vulnerability (CWE-918) has been identified in Fortinet FortiSOAR, affecting both PaaS and on-premise deployments across multiple versions. This vulnerability allows an authenticated attacker to discover services running on local ports by sending specially crafted requests to the vulnerable FortiSOAR instance.

SSRF vulnerabilities enable attackers to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. In this case, an authenticated user can leverage the flaw to probe internal network services, potentially revealing sensitive information about the infrastructure's internal topology and running services.

Critical Impact

Authenticated attackers can leverage this SSRF vulnerability to perform internal network reconnaissance, discovering services running on local ports that would otherwise be inaccessible from external networks.

Affected Products

• FortiSOAR PaaS 7.6.4, 7.6.0 through 7.6.2, 7.5.0 through 7.5.2, 7.4 all versions, 7.3 all versions
• FortiSOAR on-premise 7.6.4, 7.6.0 through 7.6.2, 7.5.0 through 7.5.2, 7.4 all versions, 7.3 all versions

Discovery Timeline

• 2026-04-14 - CVE-2025-59809 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2025-59809

Vulnerability Analysis

This SSRF vulnerability exists in Fortinet FortiSOAR's request handling mechanisms. The application fails to properly validate and restrict user-supplied URLs or network destinations, allowing authenticated users to manipulate the server into making requests to internal resources.

The vulnerability requires authentication to exploit, which somewhat limits the attack surface. However, once authenticated, an attacker can craft malicious requests that cause the FortiSOAR server to initiate connections to internal network services. This can be used to enumerate internal services, identify open ports, and map the internal network topology.

The attack is network-accessible, requires low complexity to execute, and does not require user interaction. The impact is limited to confidentiality exposure of low severity, as the attacker can only discover information about running services rather than directly access or modify data.

Root Cause

The root cause of this vulnerability is improper input validation of user-supplied URLs or destination parameters within FortiSOAR's request handling functionality. The application does not adequately validate or restrict the destinations that server-side requests can be made to, allowing authenticated users to specify internal network addresses or localhost as targets.

This violates the security principle of server-side request validation, where all user-controllable URL parameters should be validated against an allowlist of permitted destinations before the server initiates any outbound connections.

Attack Vector

The attack vector for CVE-2025-59809 is network-based, requiring the attacker to have valid authentication credentials for the FortiSOAR platform. The exploitation process involves:

1. The attacker authenticates to the FortiSOAR platform using valid credentials
2. The attacker identifies an endpoint or feature that accepts URL parameters or makes outbound requests
3. The attacker crafts a malicious request targeting internal IP addresses (e.g., 127.0.0.1, localhost, or private IP ranges)
4. The FortiSOAR server processes the request and initiates a connection to the specified internal target
5. Based on the response timing, error messages, or content returned, the attacker can determine if specific ports or services are active

This technique allows mapping of internal network services that would not otherwise be accessible from the attacker's external position. For detailed technical information, refer to the Fortinet Security Advisory FG-IR-26-103.

Detection Methods for CVE-2025-59809

Indicators of Compromise

• Unusual outbound requests from FortiSOAR servers targeting internal IP addresses or localhost
• HTTP requests containing internal IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x, 127.0.0.1) in URL parameters
• Repeated requests to sequential port numbers indicating port scanning activity
• Abnormal request patterns from authenticated users probing internal infrastructure

Detection Strategies

• Monitor FortiSOAR application logs for requests containing localhost or private IP address ranges in URL parameters
• Implement network-level monitoring to detect unusual outbound connections from FortiSOAR servers to internal resources
• Review authentication logs for suspicious user accounts making unusual request patterns
• Deploy Web Application Firewall (WAF) rules to detect and block SSRF attack patterns

Monitoring Recommendations

• Enable detailed request logging in FortiSOAR to capture URL parameters and destination addresses
• Configure SIEM alerts for FortiSOAR servers initiating connections to internal service ports
• Implement network segmentation monitoring to detect unexpected cross-segment communication from FortiSOAR instances
• Review access logs regularly for patterns indicative of internal network enumeration attempts

How to Mitigate CVE-2025-59809

Immediate Actions Required

• Review the Fortinet Security Advisory FG-IR-26-103 for the latest patch information and upgrade FortiSOAR to a patched version
• Audit user accounts with access to FortiSOAR and remove unnecessary privileges
• Implement network segmentation to limit the impact of potential SSRF exploitation
• Enable enhanced logging and monitoring on FortiSOAR instances to detect exploitation attempts

Patch Information

Fortinet has released security updates to address this vulnerability. Organizations should consult the Fortinet Security Advisory FG-IR-26-103 for specific patch versions and upgrade instructions. The advisory covers both FortiSOAR PaaS and on-premise deployments.

Affected versions requiring updates include:

• FortiSOAR PaaS and on-premise versions 7.3.x, 7.4.x, 7.5.0 through 7.5.2, 7.6.0 through 7.6.2, and 7.6.4

Workarounds

• Implement network-level controls to restrict FortiSOAR server's ability to initiate connections to internal resources
• Deploy egress filtering rules to limit outbound connections from FortiSOAR to only required external destinations
• Use a reverse proxy or WAF in front of FortiSOAR to inspect and filter potentially malicious requests
• Restrict FortiSOAR user account creation and enforce the principle of least privilege for all authenticated users

# Example network segmentation rule (iptables)
# Restrict FortiSOAR server from accessing internal network ranges
iptables -A OUTPUT -s <fortisoar_ip> -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -s <fortisoar_ip> -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -s <fortisoar_ip> -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -s <fortisoar_ip> -d 127.0.0.0/8 -j DROP