CVE-2026-23708
Full vulnerability record from the local CVENow database.
Description
A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5.0 through 7.5.2 may allow an unauthenticated attacker to bypass authentication via replaying captured 2FA request. The attack requires being able to intercept and decrypt authentication traffic and precise timing to replay the request before token expiration, which raises the attack complexity.
Severity
HIGH
CVSS score
8.1
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-14 16:16:37.277000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-23708",
"sourceIdentifier": "[email protected]",
"published": "2026-04-14T16:16:37.277",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5.0 through 7.5.2 may allow an unauthenticated attacker to bypass authentication via replaying captured 2FA request. The attack requires being able to intercept and decrypt authentication traffic and precise timing to replay the request before token expiration, which raises the attack complexity."
},
{
"lang": "es",
"value": "Una vulnerabilidad de autenticación impropia en Fortinet FortiSOAR PaaS 7.6.0 hasta 7.6.3, FortiSOAR PaaS 7.5.0 hasta 7.5.2, FortiSOAR local 7.6.0 hasta 7.6.3, FortiSOAR local 7.5.0 hasta 7.5.2 puede permitir a un atacante no autenticado eludir la autenticación mediante la repetición de una solicitud 2FA capturada. El ataque requiere poder interceptar y descifrar el tráfico de autenticación y una sincronización precisa para repetir la solicitud antes de la expiración del token, lo que aumenta la complejidad del ataque."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Fortinet",
"product": "FortiSOAR PaaS",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:fortinet:fortisoarpaas:7.6.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.6.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.5.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoarpaas:7.5.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "7.6.0",
"lessThanOrEqual": "7.6.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.5.0",
"lessThanOrEqual": "7.5.2",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Fortinet",
"product": "FortiSOAR on-premise",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:fortinet:fortisoaron-premise:7.6.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.6.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.5.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortisoaron-premise:7.5.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "7.6.0",
"lessThanOrEqual": "7.6.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.5.0",
"lessThanOrEqual": "7.5.2",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-14T00:00:00+00:00",
"id": "CVE-2026-23708",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.5.0",
"versionEndExcluding": "7.5.3",
"matchCriteriaId": "43966D08-F9B9-4CCA-BE32-649C1F08B905"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.6.0",
"versionEndExcluding": "7.6.4",
"matchCriteriaId": "6E11F916-A349-4C7F-8F39-2A3C9F2FB006"
}
]
}
]
}
],
"references": [
{
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-101",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}