CVE-2026-23708
CVE-2026-23708: 1 tracked advisory record across Fortinet. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Fortinet
1 advisory- Advisory severityMedium6.7
Medium [CVE-2026-23708] 2FA request can be replayed without a valid token after one successful request
FG-IR-26-101Source published Source updated
CVSSv3 Score: 6.7 An Improper authentication vulnerability [CWE-287] in FortiSOAR web GUI may allow an unauthenticated attacker to bypass authentication via replaying captured 2FA request. The attack requires being able to intercept and decrypt authentication traffic and precise timing to replay the request before token expiration. Revised on 2026-04-14 00:00:00
- Related products — impact not confirmed
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- FortiSOAR PaaS 7.6: 7.6.0 through 7.6.3
- FortiSOAR PaaS 7.5: 7.5.0 through 7.5.2
- FortiSOAR on-premise 7.6: 7.6.0 through 7.6.3
- FortiSOAR on-premise 7.5: 7.5.0 through 7.5.2
- Source-reported fixed versions
- FortiSOAR PaaS 7.6: 7.6.4
- FortiSOAR PaaS 7.5: 7.5.3
- FortiSOAR on-premise 7.6: 7.6.4
- FortiSOAR on-premise 7.5: 7.5.3
- Mitigation guidance
- Upgrade per the Affected/Solution table: FortiSOAR PaaS 7.6: 7.6.4; FortiSOAR PaaS 7.5: 7.5.3; FortiSOAR on-premise 7.6: 7.6.4; FortiSOAR on-premise 7.5: 7.5.3.
Android app · Google Play
Monitor future Fortinet CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.