CyberCVE

CVE-2025-59808

An unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS

Severity
Medium 6.5
CVSS 3.1
Exploited
Not listed
EPSS
0.002
10.7th percentile
Discovered by
Not disclosed
Published
Dec 9, 2025
Assigned by fortinet

Description

An unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an attacker who has already gained access to a victim's user account to reset the account credentials without being prompted for the account's password

Weakness: CWE-620

Affected products

Vendor Product Category Matched by
Fortinet FortiSOAR SIEM & Log Management cna-assigner
Vendor-reported affected versions (2)
  • Fortinet · FortiSOAR on-premise
  • Fortinet · FortiSOAR PaaS

Vendor remediation

Upgrade to FortiSOAR on-premise version 7.6.3 or above Upgrade to FortiSOAR on-premise version 7.5.2 or above Upgrade to FortiSOAR PaaS version 7.6.3 or above Upgrade to FortiSOAR PaaS version 7.5.2 or above

References