CVE-2026-84385 in FortiSOAR on-premise
Summary
by MITRE • 09/08/2026
A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.6, FortiSOAR on-premise 7.5.0 through 7.5.3, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow attacker to escalation of privilege via <insert attack vector here>
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The identified vulnerability represents a critical flaw in the access control mechanisms within Fortinet FortiSOAR platforms across multiple version ranges for both PaaS and on-premise deployments. Specifically, this issue affects FortiSOAR versions 7.3 through 7.6.6, encompassing all sub-versions within these major releases. The core of the vulnerability lies in an improper access control configuration that fails to adequately restrict user permissions based on their assigned roles or authentication status. This deficiency allows an authenticated attacker who possesses lower-level privileges to manipulate system functions and data intended for higher-privileged users or administrative accounts, thereby achieving a privilege escalation attack vector.
From a technical perspective, this flaw typically stems from insufficient validation of access rights during API requests or internal function calls within the application logic. In many modern security orchestration platforms like FortiSOAR, which handle sensitive threat intelligence and automated response workflows, strict separation of duties is paramount. When the system fails to verify that the requesting user has explicit authorization for a specific action before executing it, it creates an opportunity for unauthorized elevation of privileges. This type of vulnerability is commonly categorized under CWE-269, Improper Privilege Management, which highlights failures in ensuring that users operate only within their designated privilege levels. The lack of robust server-side validation means that client-side restrictions or role-based access control lists are either bypassed entirely or incorrectly interpreted by the backend services processing the requests.
The operational impact of this vulnerability is severe due to the nature of FortiSOAR as a Security Orchestration, Automation, and Response platform. If an attacker successfully exploits this flaw, they can escalate their privileges from a standard user account to that of an administrator or super-user. This level of access grants the ability to view, modify, or delete critical security data, including threat indicators, incident records, and automation playbooks. Furthermore, elevated privileges may allow the attacker to disable logging mechanisms, alter system configurations, or execute arbitrary commands depending on the specific implementation details of the backend infrastructure. In a PaaS environment, this could potentially lead to multi-tenant isolation failures if not properly contained, while in an on-premise deployment, it compromises the integrity and confidentiality of the entire security operations center ecosystem managed by the platform.
This vulnerability aligns with several tactics within the MITRE ATT&CK framework, particularly those related to privilege escalation such as T1078 Valid Accounts or T1548 Abuse Elevation Control Mechanism, depending on whether existing valid accounts are abused or if specific control mechanisms are bypassed. The ability to escalate privileges is a foundational step for adversaries aiming to maintain persistence and expand their foothold within a network. By gaining administrative access through this flaw, an attacker can move laterally with greater ease, exfiltrate sensitive data without detection, and potentially use the compromised FortiSOAR instance as a pivot point for further attacks against connected security tools or endpoints.
Mitigation strategies must prioritize immediate patching to the latest available version of FortiSOAR that addresses this specific access control issue. Organizations should verify their current deployment versions against the affected ranges listed in vendor advisories and apply updates provided by Fortinet promptly. In addition to software remediation, it is advisable to review role-based access controls within the platform to ensure that permissions are granted on a least-privilege basis. Regular audits of user activity logs can help detect any anomalous behavior indicative of privilege escalation attempts. Furthermore, implementing network segmentation and strict firewall rules around FortiSOAR instances can limit exposure to potential attackers who might attempt to exploit this vulnerability over the network. Continuous monitoring for unusual API calls or administrative actions performed by non-administrative accounts serves as an effective detection mechanism while patches are being deployed.