Is CVE-2026-21742 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-21742 being exploited in the wild.

How severe is CVE-2026-21742?

Medium severity, with a CVSS score of 5.7, published 14 April 2026.

Which products and versions are affected?

Fortinet Fortisoar 7.6.0 through 7.6.3, 7.5.0 through 7.5.2, 7.4 all versions, 7.3 all versions; Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, 7.5.0 through 7.5.2, 7.4 all versions, 7.3 all versions.

Is there a fix for CVE-2026-21742?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-21742 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-21742?

Check whether you run Fortinet Fortisoar or Fortinet FortiSOAR PaaS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21742: Fortinet FortiSOAR cleartext password disclosure in API responses

CVE-2026-21742 · Severity: medium · CVSS 5.7 · Published 2026-04-14

Fortinet FortiSOAR, a platform used for automating security operations and incident response, contains a vulnerability that exposes sensitive passwords. An authenticated user could view cleartext passwords for Secure Message Exchange and Radius services in system responses. This could allow an attacker with low-level access to escalate their privileges or gain unauthorized access to other connected network services.

Technologies: Fortinet Fortisoar, Fortinet FortiSOAR PaaS. Vendors: Fortinet.

Quick answers

Is CVE-2026-21742 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-21742 being exploited in the wild.
How severe is CVE-2026-21742?: Medium severity, with a CVSS score of 5.7, published 14 April 2026.
Which products and versions are affected?: Fortinet Fortisoar 7.6.0 through 7.6.3, 7.5.0 through 7.5.2, 7.4 all versions, 7.3 all versions; Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, 7.5.0 through 7.5.2, 7.4 all versions, 7.3 all versions.
Is there a fix for CVE-2026-21742?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-21742 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-21742?: Check whether you run Fortinet Fortisoar or Fortinet FortiSOAR PaaS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cleartext Transmission of Sensitive Information vulnerability (CWE-319) exists in the FortiSOAR GUI and API endpoints. The flaw is triggered when the system returns cleartext passwords in responses to queries related to Secure Message Exchange and Radius configurations. An authenticated attacker with network access can exploit this by intercepting or viewing these responses, leading to the disclosure of sensitive credentials. The vulnerability affects both PaaS and on-premise deployments across versions 7.3 through 7.6. Users are advised to upgrade to versions 7.6.4, 7.5.3, or other fixed releases as specified by the vendor.

Affected products

Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, 7.5.0 through 7.5.2, 7.4 all versions, 7.3 all versions
Fortinet FortiSOAR on-premise 7.6.0 through 7.6.2, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all versions

Timeline

2026-04-14: advisory: Initial publication by Fortinet
2026-04-14: disclosed

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-106

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.