CVE-2025-59809 MEDIUM

CVE-2025-59809

Vendor Fortinet
Product FortiSOAR on-premise
Weakness CWE-918 · SSRF
Published April 14, 2026
Last update April 14, 2026
View on NVD All CVEs

CVSS base score

4.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:H/RL:O/RC:C

What the vulnerability does

01Description

A server-side request forgery (ssrf) vulnerability [CWE-918] vulnerability in Fortinet FortiSOAR PaaS 7.6.4, FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.4, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated attacker to discover services running on local ports via crafted requests.

Key dates

02Disclosure timeline

April 14, 2026 CVE published
April 14, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-42430 OpenClaw < 2026.4.8 - Strict Browser SSRF Bypass via Playwright Redirect Handling CVE-2022-39039 aEnrich a+HRD - Server-Side Request Forgery (SSRF) CVE-2026-33540 Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm CVE-2025-53250 WordPress Chartbeat Plugin <= 2.0.7 - Server Side Request Forgery (SSRF) Vulnerability CVE-2022-45835 WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)