CVE-2026-22154

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22154", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2026-01-06T15:01:17.447Z", "datePublished": "2026-04-14T15:38:07.043Z", "dateUpdated": "2026-11-06T15:42:05.727Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiSOAR on-premise", "cpes": ["cpe:2.3:a:fortinet:fortisoar_on-premise:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.3.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "7.6.0", "lessThanOrEqual": "7.6.3", "status": "affected"}, {"versionType": "semver", "version": "7.5.0", "lessThanOrEqual": "7.5.2", "status": "affected"}, {"versionType": "semver", "version": "7.4.0", "lessThanOrEqual": "7.4.5", "status": "affected"}, {"versionType": "semver", "version": "7.3.0", "lessThanOrEqual": "7.3.3", "status": "affected"}]}, {"vendor": "Fortinet", "product": "FortiSOAR PaaS", "cpes": ["cpe:2.3:a:fortinet:fortisoarpaas:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "7.6.0", "lessThanOrEqual": "7.6.3", "status": "affected"}, {"versionType": "semver", "version": "7.5.0", "lessThanOrEqual": "7.5.2", "status": "affected"}, {"versionType": "semver", "version": "7.4.0", "lessThanOrEqual": "7.4.5", "status": "affected"}, {"versionType": "semver", "version": "7.3.0", "lessThanOrEqual": "7.3.3", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to perform a stored cross site scripting (XSS) attack via crafted HTTP Requests."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-11-06T15:42:05.727Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "Escalation of privilege", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:H/RL:O/RC:C"}}], "solutions": [{"lang": "en", "value": "Upgrade to FortiSOAR on-premise version 7.6.4 or above\nUpgrade to FortiSOAR on-premise version 7.5.3 or above\nUpgrade to FortiSOAR PaaS version 7.6.4 or above\nUpgrade to FortiSOAR PaaS version 7.5.3 or above"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-117", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-117"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22154", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T16:35:48.704992Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T16:46:17.029Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22154", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T16:35:48.704992Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T16:37:30.721Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:H/RL:O/RC:C", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:2.3:a:fortinet:fortisoar_on-premise:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.3.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiSOAR on-premise", "versions": [{"status": "affected", "version": "7.6.0", "versionType": "semver", "lessThanOrEqual": "7.6.3"}, {"status": "affected", "version": "7.5.0", "versionType": "semver", "lessThanOrEqual": "7.5.2"}, {"status": "affected", "version": "7.4.0", "versionType": "semver", "lessThanOrEqual": "7.4.5"}, {"status": "affected", "version": "7.3.0", "versionType": "semver", "lessThanOrEqual": "7.3.3"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:fortinet:fortisoarpaas:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiSOAR PaaS", "versions": [{"status": "affected", "version": "7.6.0", "versionType": "semver", "lessThanOrEqual": "7.6.3"}, {"status": "affected", "version": "7.5.0", "versionType": "semver", "lessThanOrEqual": "7.5.2"}, {"status": "affected", "version": "7.4.0", "versionType": "semver", "lessThanOrEqual": "7.4.5"}, {"status": "affected", "version": "7.3.0", "versionType": "semver", "lessThanOrEqual": "7.3.3"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to FortiSOAR on-premise version 7.6.4 or above\nUpgrade to FortiSOAR on-premise version 7.5.3 or above\nUpgrade to FortiSOAR PaaS version 7.6.4 or above\nUpgrade to FortiSOAR PaaS version 7.5.3 or above"}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-117", "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-117"}], "descriptions": [{"lang": "en", "value": "An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to perform a stored cross site scripting (XSS) attack via crafted HTTP Requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Escalation of privilege"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-11-06T15:42:05.727Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22154", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:42:05.727Z", "dateReserved": "2026-01-06T15:01:17.447Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2026-04-14T15:38:07.043Z", "assignerShortName": "fortinet"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:fortinet:fortisoar_on-premise:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoar_on-premise:7.3.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "FortiSOAR on-premise", "vendor": "Fortinet", "versions": [{"lessThanOrEqual": "7.6.3", "status": "affected", "version": "7.6.0", "versionType": "semver"}, {"lessThanOrEqual": "7.5.2", "status": "affected", "version": "7.5.0", "versionType": "semver"}, {"lessThanOrEqual": "7.4.5", "status": "affected", "version": "7.4.0", "versionType": "semver"}, {"lessThanOrEqual": "7.3.3", "status": "affected", "version": "7.3.0", "versionType": "semver"}]}, {"cpes": ["cpe:2.3:a:fortinet:fortisoarpaas:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisoarpaas:7.3.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "FortiSOAR PaaS", "vendor": "Fortinet", "versions": [{"lessThanOrEqual": "7.6.3", "status": "affected", "version": "7.6.0", "versionType": "semver"}, {"lessThanOrEqual": "7.5.2", "status": "affected", "version": "7.5.0", "versionType": "semver"}, {"lessThanOrEqual": "7.4.5", "status": "affected", "version": "7.4.0", "versionType": "semver"}, {"lessThanOrEqual": "7.3.3", "status": "affected", "version": "7.3.0", "versionType": "semver"}]}], "source": "psirt@fortinet.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*", "matchCriteriaId": "CD42D7DF-B095-44E1-B7E1-D203678DF740", "versionEndExcluding": "7.5.3", "versionStartIncluding": "7.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*", "matchCriteriaId": "6E11F916-A349-4C7F-8F39-2A3C9F2FB006", "versionEndExcluding": "7.6.4", "versionStartIncluding": "7.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to perform a stored cross site scripting (XSS) attack via crafted HTTP Requests."}, {"lang": "es", "value": "Una vulnerabilidad de neutralizaci\u00f3n inadecuada de la entrada durante la generaci\u00f3n de p\u00e1ginas web (\u2019cross-site scripting\u2019) en Fortinet FortiSOAR PaaS 7.6.0 a 7.6.3, FortiSOAR PaaS 7.5.0 a 7.5.2, FortiSOAR PaaS 7.4 todas las versiones, FortiSOAR PaaS 7.3 todas las versiones, FortiSOAR on-premise 7.6.0 a 7.6.3, FortiSOAR on-premise 7.5.0 a 7.5.2, FortiSOAR on-premise 7.4 todas las versiones, FortiSOAR on-premise 7.3 todas las versiones puede permitir a un atacante remoto autenticado realizar un ataque de cross-site scripting (XSS) almacenado a trav\u00e9s de solicitudes HTTP manipuladas."}], "id": "CVE-2026-22154", "lastModified": "2026-11-06T16:17:56.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "psirt@fortinet.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22154", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T16:35:48.704992Z", "version": "2.0.3"}}]}, "published": "2026-04-14T16:16:36.077", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-117"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.6.0,7.6.3]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.5.0,7.5.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.4.0,7.4.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.3.0,7.3.3]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "FortiSOAR on-premise", "source": "cna", "vendor": "Fortinet"}, "product": "fortisoaron-premise", "vendor": "fortinet"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.6.0,7.6.3]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.5.0,7.5.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.4.0,7.4.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.3.0,7.3.3]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "FortiSOAR PaaS", "source": "cna", "vendor": "Fortinet"}, "product": "fortisoarpaas", "vendor": "fortinet"}], "analysis": {"en": {"generated_at": "2026-04-14T17:44:01.122265+00:00", "value": {"mitigation_remediation": ["Upgrade FortiSOAR on\u2011premise to version 7.6.4 or later.", "Upgrade FortiSOAR PaaS to version 7.6.4 or later.", "Verify that the current deployment runs a version that is at least 7.6.4 to ensure the stored XSS vulnerability is patched."], "summary": {"action": "Upgrade", "impact": "Stored cross\u2011site scripting that can be leveraged by authenticated remote attackers."}, "threat_synthesis": {"affected_systems": "Affected products include Fortinet FortiSOAR PaaS versions 7.3.x through 7.6.3 and FortiSOAR on\u2011premise versions 7.3.x through 7.6.3. The vendor recommends upgrading to on\u2011premise 7.6.4 or higher and to PaaS 7.6.4 or higher; earlier 7.5.3 releases also contain the fix. All earlier releases listed remain vulnerable.", "description_and_impact": "Fortinet FortiSOAR PaaS and on\u2011premise deployments have a stored cross\u2011site scripting weakness (CWE\u201179) that lets an authenticated remote attacker inject malicious scripts into the web interface via crafted HTTP requests. The inserted JavaScript runs in the victim\u2019s browser session, enabling session hijacking, credential theft, UI defacement, or other content\u2011manipulating attacks. The flaw originates from insufficient sanitization of user\u2011supplied data when generating web pages.", "risk_and_exploitability": "The CVSS score of 4.4 classifies the issue as moderate, impacting web application integrity and confidentiality. EPSS data is unavailable, and the vulnerability is not in the CISA KEV catalog. Because the flaw requires authentic credentials, exploitation likelihood hinges on credential compromise, yet any successful misuse can have significant damage to user sessions in a shared web UI."}}}}, "created": "2026-04-15T14:41:09.661996+00:00", "title": "Stored Cross\u2011Site Scripting in FortiSOAR Web Interface", "updated": "2026-04-15T15:30:06.825207+00:00", "vendors": ["fortinet", "fortinet$PRODUCT$fortisoaron-premise", "fortinet$PRODUCT$fortisoarpaas"]}