CVE-2025-59809

A server-side request forgery (ssrf) vulnerability [CWE-918] vulnerability in Fortinet FortiSOAR PaaS 7.6.4, FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.4, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated attacker to discover services running on local ports via crafted requests.

Score

CVSS 3.1 4.3 Medium

Status

Analyzed - psirt@fortinet.com

Published

2026-04-14

Last modified

2026-10-14

Weaknesses

CWE-918

Affected products

• Fortisoar (Fortinet)
• Fortisoaron-premise (Fortinet)
• Fortisoarpaas (Fortinet)

References

• https://fortiguard.fortinet.com/psirt/FG-IR-26-103