Fortinet FortiSOAR PaaS and on‑premise deployments have a stored cross‑site scripting weakness (CWE‑79) that lets an authenticated remote attacker inject malicious scripts into the web interface via crafted HTTP requests. The inserted JavaScript runs in the victim’s browser session, enabling session hijacking, credential theft, UI defacement, or other content‑manipulating attacks. The flaw originates from insufficient sanitization of user‑supplied data when generating web pages.

Affected products include Fortinet FortiSOAR PaaS versions 7.3.x through 7.6.3 and FortiSOAR on‑premise versions 7.3.x through 7.6.3. The vendor recommends upgrading to on‑premise 7.6.4 or higher and to PaaS 7.6.4 or higher; earlier 7.5.3 releases also contain the fix. All earlier releases listed remain vulnerable.

The CVSS score of 4.4 classifies the issue as moderate, impacting web application integrity and confidentiality. EPSS data is unavailable, and the vulnerability is not in the CISA KEV catalog. Because the flaw requires authentic credentials, exploitation likelihood hinges on credential compromise, yet any successful misuse can have significant damage to user sessions in a shared web UI.