CVE-2026-21742
Full vulnerability record from the local CVENow database.
Description
A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated attacker to view cleartext password in response for Secure Message Exchange and Radius queries, if configured
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-14 16:16:35.930000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-21742",
"sourceIdentifier": "[email protected]",
"published": "2026-04-14T16:16:35.930",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated attacker to view cleartext password in response for Secure Message Exchange and Radius queries, if configured"
},
{
"lang": "es",
"value": "Una vulnerabilidad de transmisión en texto claro de información sensible en Fortinet FortiSOAR PaaS 7.6.0 hasta 7.6.3, FortiSOAR PaaS 7.5.0 hasta 7.5.2, FortiSOAR PaaS 7.4 todas las versiones, FortiSOAR PaaS 7.3 todas las versiones, FortiSOAR on-premise 7.6.0 hasta 7.6.2, FortiSOAR on-premise 7.5.0 hasta 7.5.1, FortiSOAR on-premise 7.4 todas las versiones, FortiSOAR on-premise 7.3 todas las versiones puede permitir a un atacante autenticado ver la contraseña en texto claro en respuesta a consultas de Secure Message Exchange y Radius, si está configurado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Fortinet",
"product": "FortiSOAR on-premise",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:fortinet:fortisoaron-premise:7.6.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.3.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.3.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.3.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "7.6.0",
"lessThanOrEqual": "7.6.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.5.0",
"lessThanOrEqual": "7.5.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.4.0",
"lessThanOrEqual": "7.4.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.3.0",
"lessThanOrEqual": "7.3.3",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Fortinet",
"product": "FortiSOAR PaaS",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:fortinet:fortisoarpaas:7.6.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.3.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.3.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.3.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "7.6.0",
"lessThanOrEqual": "7.6.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.5.0",
"lessThanOrEqual": "7.5.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.4.0",
"lessThanOrEqual": "7.4.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.3.0",
"lessThanOrEqual": "7.3.3",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.1,
"impactScore": 3.6
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-14T16:35:12.570489Z",
"id": "CVE-2026-21742",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-319"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.3.0",
"versionEndExcluding": "7.5.3",
"matchCriteriaId": "CD42D7DF-B095-44E1-B7E1-D203678DF740"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.6.0",
"versionEndExcluding": "7.6.4",
"matchCriteriaId": "6E11F916-A349-4C7F-8F39-2A3C9F2FB006"
}
]
}
]
}
],
"references": [
{
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-106",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}