A storing passwords in a recoverable format vulnerability in FortiSOAR allows a remote attacker who authenticates to the system to modify connector configuration. This action creates stored passwords in a recoverable format, so the attacker can retrieve the plaintext credentials for multiple installed connectors. The flaw, a password storage weakness (CWE-257, CWE-522), can expose sensitive authentication information.

Fortinet FortiSOAR PaaS versions 7.6.0 through 7.6.4, 7.5.0 through 7.5.2, all 7.4 releases, and all 7.3 releases are affected. Fortinet FortiSOAR on‑premise versions 7.6.0 through 7.6.4, 7.5.0 through 7.5.2, all 7.4 releases, and all 7.3 releases are also impacted. Both cloud‑based PaaS and on‑premise deployments are vulnerable.

The vulnerability has a CVSS score of 4.1, indicating moderate severity. The EPSS score of 0.00041 (less than 1%) suggests an extremely low probability of exploitation. Because exploitation requires an authenticated session with permission to modify connector configuration, an attacker must have privileged access. The flaw is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been reported yet.