CVE-2026-23708
HighSummary
An improper authentication vulnerability exists in Fortinet FortiSOAR PaaS versions 7.6.0 through 7.6.3 and 7.5.0 through 7.5.2, as well as in on-premise versions 7.6.0 through 7.6.3 and 7.5.0 through 7.5.2. An unauthenticated attacker may bypass authentication by replaying a captured 2FA request.
Risk Assessment
The organization may be exposed to attacks that allow unauthorized users to gain access to the system, potentially leading to data breaches or other serious security incidents.
Recommendation
It is recommended to update FortiSOAR to the latest version to mitigate this vulnerability and implement additional security measures such as monitoring network traffic.
Related vulnerabilities
- CVE-2026-90558Critical
sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.
- CVE-2026-78159Critical
The Events Calendar plugin for WordPress in all versions up to and including 6.17.3 is vulnerable to Remote Code Execution via the parse_array function. Insufficient validation of the widget 'classes' map allows a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This enables unauthenticated attackers to execute code on the server, provided comments are enabled on tribe_events posts and at least one comment containing a crafted wp:legacy-widget block has been submitted.
- CVE-2026-78006Critical
The Events Calendar plugin for WordPress in all versions up to and including 6.17.4 is vulnerable to Remote Code Execution via the is_safe_widget_instance function. Insufficient protection in is_safe_widget_instance can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This enables unauthenticated attackers to execute code on the server, as the plugin's V2 single-event template runs do_blocks() over buffered comment HTML and WordPress returns a moderation-hash URL allowing an unauthenticated commenter to immediately view their own pending comment.
- CVE-2026-85681Critical
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
- CVE-2026-84171Critical
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.
- CVE-2026-82845Critical
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the plugin, write and execute arbitrary code on the server. A weaker form of the same issue is reachable without an account and yields an arbitrary file write rather than code execution.
- CVE-2026-81402Critical
The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code execution.
- CVE-2026-77006Critical
The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
- CVE-2026-77005Critical
The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.
- CVE-2026-75800Critical
The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.
Original NVD description (English source)
A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5.0 through 7.5.2 may allow an unauthenticated attacker to bypass authentication via replaying captured 2FA request. The attack requires being able to intercept and decrypt authentication traffic and precise timing to replay the request before token expiration, which raises the attack complexity.