CVE-2026-22576: Fortinet FortiSOAR Info Disclosure Bug

CVE-2026-22576 Overview

CVE-2026-22576 affects Fortinet FortiSOAR in both PaaS and on-premise deployments. The vulnerability stems from storing passwords in a recoverable format within connector configurations [CWE-257, CWE-522]. An authenticated remote attacker can retrieve passwords for multiple installed connectors by modifying the server address in the connector configuration. This redirects authentication attempts to an attacker-controlled endpoint, exposing stored credentials in cleartext form.

Critical Impact
Authenticated attackers can harvest credentials for every connector configured in FortiSOAR, enabling lateral movement into integrated security tools, ticketing systems, and cloud platforms.

Affected Products

Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, 7.5.0 through 7.5.2, and all versions of 7.4 and 7.3
Fortinet FortiSOAR on-premise 7.6.0 through 7.6.4, 7.5.0 through 7.5.2, and all versions of 7.4 and 7.3
All FortiSOAR connector integrations storing remote authentication credentials

Discovery Timeline

2026-04-14 - CVE-2026-22576 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-22576

Vulnerability Analysis

FortiSOAR uses connectors to integrate with external platforms such as ticketing systems, threat intelligence feeds, EDR tools, and cloud services. Each connector stores authentication credentials needed to communicate with its backend service. The vulnerability arises because FortiSOAR stores these credentials in a recoverable format rather than as one-way hashes or sealed secrets bound to the original endpoint.

An authenticated user with permission to edit connector configurations can change the server address field to point to an attacker-controlled host. When FortiSOAR initiates a connection using the stored credential, it transmits the recovered password to the new address. The platform performs no validation that the destination address matches the original endpoint the credential was provisioned for.

This design weakness exposes credentials across the full inventory of installed connectors, not just a single integration. The attack does not require administrative privileges, only access sufficient to modify connector settings.

Root Cause

The root cause is the use of reversible encryption for stored connector passwords combined with the absence of endpoint-binding controls. FortiSOAR must be able to recover the plaintext credential to authenticate with remote services, which conflicts with the principle of storing secrets in a non-recoverable form. Without binding the credential to a specific server identity, the platform cannot detect address tampering before transmission.

Attack Vector

The attack vector is network-based and requires low-privilege authenticated access to the FortiSOAR interface. An attacker logs in, navigates to an existing connector configuration, and replaces the legitimate server hostname or IP with an endpoint they control. The attacker then triggers any connector action that initiates outbound authentication. The FortiSOAR backend decrypts the stored password and sends it to the attacker-controlled listener, which captures the cleartext credential. The process can be repeated across every configured connector.

No verified public exploitation code is available. See the FortiGuard Security Advisory FG-IR-26-104 for vendor technical details.

Detection Methods for CVE-2026-22576

Indicators of Compromise

Unexpected modifications to the server address, hostname, or URL field in FortiSOAR connector configurations
Outbound connections from the FortiSOAR appliance to unrecognized external IPs or domains over connector protocols
Audit log entries showing connector configuration updates by accounts that do not typically perform integration management
Authentication failures in downstream integrated platforms following FortiSOAR configuration changes

Detection Strategies

Enable and review FortiSOAR audit logging for all connector configuration changes, focusing on server address fields
Correlate connector edit events with subsequent outbound network connections from the FortiSOAR host
Baseline the expected destination endpoints for each connector and alert on deviations
Monitor for credential reuse alerts in integrated systems that may indicate harvested passwords being replayed

Monitoring Recommendations

Forward FortiSOAR audit logs to a centralized SIEM with OCSF normalization for cross-source correlation
Implement egress filtering on the FortiSOAR appliance to restrict outbound traffic to known integration endpoints
Alert on any connector configuration change occurring outside approved change-management windows

How to Mitigate CVE-2026-22576

Immediate Actions Required

Restrict FortiSOAR user permissions so that only a minimal set of trusted administrators can modify connector configurations
Audit all existing connector configurations to confirm server addresses match expected endpoints
Rotate credentials for every connector once a patched version is installed, as previously stored passwords must be considered exposed
Apply the vendor-supplied fixed version as identified in FortiGuard advisory FG-IR-26-104

Patch Information

Fortinet has published remediation guidance in the FortiGuard Security Advisory FG-IR-26-104. Administrators should consult the advisory for the specific fixed build numbers for FortiSOAR PaaS and on-premise deployments and upgrade to the listed remediated releases.

Workarounds

Limit connector configuration privileges to a small, audited group of administrators using FortiSOAR role-based access control
Enforce change-control approvals for any modification to connector server address fields
Apply egress network controls so that the FortiSOAR appliance can only reach the expected integration endpoints
Monitor audit logs continuously for connector configuration changes and respond to anomalies promptly

bash

# Example: restrict egress from FortiSOAR host to known integration endpoints only
# Replace 198.51.100.10 and 203.0.113.20 with actual integration IPs
iptables -A OUTPUT -d 198.51.100.10 -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -d 203.0.113.20 -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j DROP