CVE-2026-22155

OVERVIEW CVE-2026-22155 is a cleartext transmission vulnerability affecting multiple versions of Fortinet FortiSOAR across both PaaS and on-premise deployments, including versions 7.3 through 7.6.3. The vulnerability allows unauthorized disclosure of sensitive information through an unspecified attack vector, impacting numerous organizations that rely on FortiSOAR for security orchestration and incident response. SEVERITY The vulnerability carries a CVSS 3.1 score of 6.5 (Medium) with a network-based attack vector requiring low complexity and user authentication. The impact is limited to confidentiality compromise with no integrity or availability effects. While the EPSS score of 0.00015 indicates relatively low prevalence among all known vulnerabilities, the requirement for network access and authenticated user status moderately reduces exploitation likelihood. EXPLOITATION STATUS This vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog, indicating no confirmed active exploitation in the wild. The vulnerability maintains an inactive status on the Hot List, suggesting minimal community attention and no readily available public exploit code. Organizations should prioritize patching based on their FortiSOAR deployment scope and data sensitivity rather than imminent exploitation threats.