Improper Access Control in Fortinet FortiSOAR

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: Fortinet, Inc.

Description

A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.6, FortiSOAR on-premise 7.5.0 through 7.5.3, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow attacker to escalation of privilege via <insert attack vector here>

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-84385

Affected Vendors & Products

Vendor	Product	Version / Range
fortinet	fortisoar_paas	From 7.6.0 (inc) to 7.6.6 (inc)
fortinet	fortisoar_paas	From 7.5.0 (inc) to 7.5.3 (inc)
fortinet	fortisoar_paas	7.4
fortinet	fortisoar_paas	7.3
fortinet	fortisoar_on-premise	From 7.6.0 (inc) to 7.6.6 (inc)
fortinet	fortisoar_on-premise	From 7.5.0 (inc) to 7.5.3 (inc)
fortinet	fortisoar_on-premise	7.4
fortinet	fortisoar_on-premise	7.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is an improper access control vulnerability in Fortinet FortiSOAR versions 7.3 through 7.6.6. It allows attackers to escalate privileges by exploiting unspecified attack vectors.

Impact Analysis

An attacker could gain elevated privileges on affected FortiSOAR systems, potentially leading to unauthorized access, data manipulation, or further network compromise.

Mitigation Strategies

Update FortiSOAR to the latest patched version immediately. Disable unnecessary user privileges and review access controls. Monitor for unusual privilege escalation attempts.

Hi! I’m here to help you understand CVE-2026-84385. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70