Fortinet FortiSOAR PaaS/FortiSOAR on-premise up to 7.3.3/7.4.5/7.5.1/7.6.2 Secure Message cleartext transmission

Summaryinfo

A vulnerability identified as problematic has been detected in Fortinet FortiSOAR PaaS and FortiSOAR on-premise up to 7.3.3/7.4.5/7.5.1/7.6.2. This affects an unknown part of the component Secure Message Handler. The manipulation leads to cleartext transmission. This vulnerability is traded as CVE-2026-21742. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Fortinet FortiSOAR PaaS and FortiSOAR on-premise up to 7.3.3/7.4.5/7.5.1/7.6.2 and classified as problematic. This issue affects some unknown functionality of the component Secure Message Handler. The manipulation with an unknown input leads to a cleartext transmission vulnerability. Using CWE to declare the problem leads to CWE-319. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. Impacted is confidentiality. The summary by CVE is:

A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated attacker to view cleartext password in response for Secure Message Exchange and Radius queries, if configured

It is possible to read the advisory at fortiguard.fortinet.com. The identification of this vulnerability is CVE-2026-21742 since 01/05/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1040 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Fortinet

Name

• FortiSOAR on-premise
• FortiSOAR PaaS

Version

• 7.3.0
• 7.3.1
• 7.3.2
• 7.3.3
• 7.4.0
• 7.4.1
• 7.4.2
• 7.4.3
• 7.4.4
• 7.4.5
• 7.5.0
• 7.5.1
• 7.6.0
• 7.6.1
• 7.6.2

License

• commercial

Website

• Vendor: https://www.fortinet.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion