A vulnerability identified as CWE-319 allows an authenticated attacker to receive sensitive information, specifically cleartext passwords, in the response to Secure Message Exchange and Radius queries. In Fortinet FortiSOAR PaaS and on-premise deployments, when these features are enabled, credentials are transmitted in plaintext over the network. The attacker gains compromise of user credentials, potentially enabling credential reuse or compromise of other services.

Clients of Fortinet FortiSOAR PaaS, versions up to 7.6.3 and 7.5.2, and all 7.4 and 7.3 releases, are affected. On‑premise installations from version 7.6.2 down to 7.3 are also vulnerable. The issue is present regardless of the deployment model and applies to all Fortinet FortiSOAR versions listed in the advisory.

The CVSS score of 5.4 indicates a medium impact, and since the vulnerability requires an authenticated session, the likelihood of exploitation is contingent on an attacker’s access to FortiSOAR administrative functions. Although an EPSS score is not available and the vulnerability is not in the CISA KEV catalog, an attacker who gains legitimate credentials can easily capture cleartext passwords during normal network traffic. Therefore, the risk is moderate but potentially significant to confidentiality.