PT-2026-32651 · Fortinet · Fortisoar Paas+2

Published 2026-04-14 · Updated 2026-05-06 · CVE-2025-59809

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiSOAR PaaS version 7.6.4 FortiSOAR PaaS versions 7.6.0 through 7.6.2 FortiSOAR PaaS versions 7.5.0 through 7.5.2 FortiSOAR PaaS versions 7.4 and earlier FortiSOAR PaaS versions 7.3 and earlier FortiSOAR on-premise version 7.6.4 FortiSOAR on-premise versions 7.6.0 through 7.6.2 FortiSOAR on-premise versions 7.5.0 through 7.5.2 FortiSOAR on-premise versions 7.4 and earlier FortiSOAR on-premise versions 7.3 and earlier

Description A server-side request forgery (SSRF) allows an authenticated attacker to discover services running on local ports via crafted requests. SSRF is a flaw where a server is tricked into making requests to an unintended location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-59809

Affected Products

Fortisoar Paas

Fortisoar On-Premise

Fortisoar

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-59809 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-26-103 · Vendor Advisory
• https://t.me/cveNotify/162380 · Telegram Post
• https://twitter.com/CVEnew/status/2045889774351790332 · Twitter Post