CVE-2026-21742

State: Published
Severity: 5.4 Medium
Published: Apr 14, 2026
Updated: Jul 8, 2026
Reserved: Jan 5, 2026

Description

A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated attacker to view cleartext password in response for Secure Message Exchange and Radius queries, if configured

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C	fortinet

Weaknesses

CWE-319 Information disclosure

Affected Products

Product	Versions
FortiSOAR on-premiseFortinet	7.6.0 through 7.6.2Affected 7.5.0 through 7.5.1Affected 7.4.0 through 7.4.5Affected 7.3.0 through 7.3.3Affected
FortiSOAR PaaSFortinet	7.6.0 through 7.6.2Affected 7.5.0 through 7.5.1Affected 7.4.0 through 7.4.5Affected 7.3.0 through 7.3.3Affected

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-106

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.