{"affected":[{"defaultStatus":"unaffected","product":"FortiSOAR on-premise","source":"CNA: fortinet","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.5.3","status":"affected","version":"7.5.0","versionType":"semver"},{"lessThanOrEqual":"7.4.5","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.3.3","status":"affected","version":"7.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"FortiSOAR PaaS","source":"CNA: fortinet","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.5.3","status":"affected","version":"7.5.0","versionType":"semver"},{"lessThanOrEqual":"7.4.5","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.3.3","status":"affected","version":"7.3.0","versionType":"semver"}]}],"cveId":"CVE-2026-84385","cwes":["CWE-284"],"description":"A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.6, FortiSOAR on-premise 7.5.0 through 7.5.3, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow attacker to escalation of privilege via <insert attack vector here>","epss":{"date":"2026-11-03","percentile":0.1394,"score":0.0023},"exploits":[],"kev":null,"metrics":[{"score":4.9,"severity":"medium","source":"CNA: fortinet","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C","version":"3.1"},{"score":5.4,"severity":"medium","source":"NVD: psirt@fortinet.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793747877440,"publishedAt":1788885706444,"references":[{"source":"CNA: fortinet","tags":[],"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-164"},{"source":"psirt@fortinet.com","tags":[],"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-164"}],"remediation":[{"kind":"fix","source":"CNA: fortinet","text":"Upgrade to FortiSOAR PaaS version 8.0.0 or above\nUpgrade to FortiSOAR PaaS version 7.6.7 or above\nUpgrade to FortiSOAR PaaS version 7.5.4 or above\nUpgrade to FortiSOAR on-premise version 8.0.0 or above\nUpgrade to FortiSOAR on-premise version 7.6.7 or above\nUpgrade to FortiSOAR on-premise version 7.5.4 or above"}],"revision":"5b156aa9f49092895ebe236496c85e738dbc090a0e6a5e571e3173e7f8c8d517","sources":[{"modifiedAt":1793744617458,"name":"CNA: fortinet","retrievedAt":1793748378372,"url":"https://www.cve.org/CVERecord?id=CVE-2026-84385"},{"modifiedAt":1793747877440,"name":"NVD","retrievedAt":1793751436772,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84385"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793748397359,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84385"}],"ssvc":{"assessedAt":1789012612186,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2026-84385","updatedAt":1793751436772}