CVE-2026-21742

A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated attacker to view cleartext password in response for Secure Message Exchange and Radius queries, if configured

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - psirt@fortinet.com

Published

2026-04-14

Last modified

2026-10-26

Weaknesses

CWE-319

Affected products

• Fortisoar (Fortinet)
• Fortisoaron-premise (Fortinet)
• Fortisoarpaas (Fortinet)

References

• https://fortiguard.fortinet.com/psirt/FG-IR-26-106