The vulnerability CVE-2026-23708 in Fortinet FortiSOAR PaaS and on-premise versions 7.5.0 to 7.5.2 and 7.6.0 to 7.6.3 is caused by improper authentication. It enables an unauthenticated attacker to bypass authentication by replaying a captured 2FA request. Exploitation requires the attacker to intercept and decrypt authentication traffic and replay the request within the token's valid timeframe, which increases attack complexity. The vulnerability has a CVSS 3.1 base score of 6.7, indicating medium severity with network attack vector, high impact on confidentiality, integrity, and availability, and partial user interaction required. An official fix has been released by Fortinet.

If exploited, this vulnerability allows an unauthenticated attacker to bypass authentication mechanisms and escalate privileges within FortiSOAR environments. The attacker can gain unauthorized access, potentially compromising confidentiality, integrity, and availability of the system. However, the attack complexity is high due to the need to intercept and decrypt authentication traffic and precisely time the replay of the 2FA request. There are no known exploits in the wild at this time.

An official patch is available from Fortinet to remediate this vulnerability. Users should apply the patch promptly to affected FortiSOAR versions 7.5.0 through 7.5.2 and 7.6.0 through 7.6.3. Since this is not a cloud service, remediation depends on the user applying the update. No additional mitigation steps are indicated by the vendor advisory.