A storing passwords in a recoverable format vulnerability in FortiSOAR allows a remote attacker who authenticates to the system to modify connector configuration. This action creates stored passwords in a recoverable format, so the attacker can retrieve the plaintext credentials for multiple installed connectors. The flaw is a password storage weakness that can expose sensitive authentication information.

Fortinet FortiSOAR PaaS versions 7.6.0 through 7.6.4, 7.5.0 through 7.5.2, all 7.4 releases, and all 7.3 releases are affected. Fortinet FortiSOAR on‑premise versions 7.6.0 through 7.6.4, 7.5.0 through 7.5.2, all 7.4 releases, and all 7.3 releases are also impacted. Both cloud‑based PaaS and on‑premise deployments are vulnerable.

The vulnerability has a CVSS score of 4.1, indicating moderate severity. EPSS data is not available, so the likelihood of exploitation in the wild is not quantified. Because exploitation requires an authenticated session with permission to modify connector configuration, an attacker must have privileged access. The flaw is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been reported yet.