Skip to content
Sign in
4.4 Medium

CVE-2026-22154 An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet…

Description

An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to perform a stored cross site scripting (XSS) attack via crafted HTTP Requests.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:H/RL:O/RC:C

Exploitable remotely over the network, with an ordinary account and if a user takes an action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Privileges required
Low
Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Affected products and versions

Product Affected versions Fixed in
FortiSOAR PaaS 7.6 7.6.0 → 7.6.3 No fix stated
FortiSOAR PaaS 7.5 7.5.0 → 7.5.2 No fix stated
FortiSOAR PaaS 7.4 7.4.0 → 7.4.5 No fix stated
FortiSOAR PaaS 7.3 7.3.0 → 7.3.3 No fix stated
FortiSOAR on-premise 7.6 7.6.0 → 7.6.3 No fix stated
FortiSOAR on-premise 7.5 7.5.0 → 7.5.2 No fix stated
FortiSOAR on-premise 7.4 7.4.0 → 7.4.5 No fix stated
FortiSOAR on-premise 7.3 7.3.0 → 7.3.3 No fix stated

Other CVEs of FortiSOAR PaaS

The 11 CVEs of FortiSOAR PaaS →
CVE-2026-84385 A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through… 4.9 Medium CVE-2026-22573 An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSOAR… 6.2 Medium CVE-2026-23708 A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through… 6.7 Medium CVE-2025-59809 A server-side request forgery (ssrf) vulnerability [CWE-918] vulnerability in Fortinet FortiSOAR PaaS 7.6.4, FortiSOAR… 4.1 Medium
Track this CVE