Is CVE-2026-84385 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84385 being exploited in the wild.

How severe is CVE-2026-84385?

Medium severity, with a CVSS score of 5.4, published 8 September 2026.

Which products and versions are affected?

Fortinet Fortisoar 7.3 all versions, 7.4 all versions, 7.5.0 through 7.5.3, 7.6.0 through 7.6.6; Fortinet FortiSOAR PaaS 7.3 all versions, 7.4 all versions, 7.5.0 through 7.5.3, 7.6.0 through 7.6.6.

Is there a fix for CVE-2026-84385?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-84385 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84385?

Check whether you run Fortinet Fortisoar or Fortinet FortiSOAR PaaS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84385: Fortinet FortiSOAR improper access control in WebSocket streams

CVE-2026-84385 · Severity: medium · CVSS 5.4 · Published 2026-09-08

FortiSOAR is a security orchestration and incident response platform used by enterprises to automate security operations. An improper access control vulnerability allows authenticated users with minimal permissions to subscribe to restricted WebSocket data streams and inject false messages into the system, potentially enabling privilege escalation and data manipulation within security operations workflows.

Technologies: Fortinet Fortisoar, Fortinet FortiSOAR PaaS. Vendors: Fortinet.

Quick answers

Is CVE-2026-84385 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84385 being exploited in the wild.
How severe is CVE-2026-84385?: Medium severity, with a CVSS score of 5.4, published 8 September 2026.
Which products and versions are affected?: Fortinet Fortisoar 7.3 all versions, 7.4 all versions, 7.5.0 through 7.5.3, 7.6.0 through 7.6.6; Fortinet FortiSOAR PaaS 7.3 all versions, 7.4 all versions, 7.5.0 through 7.5.3, 7.6.0 through 7.6.6.
Is there a fix for CVE-2026-84385?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84385 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84385?: Check whether you run Fortinet Fortisoar or Fortinet FortiSOAR PaaS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper access control flaw (CWE-284) in FortiSOAR's WebSocket stream handler that fails to properly validate user permissions before allowing subscription to protected topics and message broadcast injection. An authenticated attacker with zero permissions can craft malicious WebSocket requests to bypass access restrictions, subscribe to sensitive security event streams, and inject broadcast messages to manipulate incident response workflows. The vulnerability requires valid authentication but does not require elevated privileges. Fortinet has released patches for affected versions: 7.6.7+, 7.5.4+; versions 7.3 and 7.4 require migration to a fixed release.

Affected products

Fortinet FortiSOAR PaaS 7.3 all versions, 7.4 all versions, 7.5.0 through 7.5.3, 7.6.0 through 7.6.6
Fortinet FortiSOAR 7.3 all versions, 7.4 all versions, 7.5.0 through 7.5.3, 7.6.0 through 7.6.6

Timeline

2026-09-08: disclosed

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-164

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.