Multiple Node.js CVEs
FG-IR-26-187
Summary
CVSSv3 Score:
5.4
An Improper Access control vulnerability [CWE-284] in FortiSOAR may allow an authenticated attacker with zero permissions to subscribe to websocket streams and topics and to inject broadcast messages to the stream via crafted websocket requests
Revised on 2026-09-08 00:00:00
Products covered
FortiSOAR
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Update history
What changed in later vendor updates
SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.
- The vendor changed the advisory summary.
- CVSS changed from 4.9 to 5.4.
- Added CVEs: CVE-2026-84385.
Updates
- Published by Fortinet
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.