CVE-2019-6693
Published 2019-11-21 · Updated 2026-08-04 · Source psirt@fortinet.com
Summary
CVE-2019-6693 is a medium-severity (CVSS 6.5) vulnerability in Fortinet FortiOS. CISA added it to the Known Exploited Vulnerabilities catalog on June 25, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by July 16, 2025. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Fortinet has 32 vulnerabilities in the KEV catalog, 14 of them linked to ransomware.
All 32 known-exploited Fortinet vulnerabilities →Description
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA Known-Exploited Vulnerability
Product: Fortinet — FortiOS
Name: Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
Date added: 2025-06-25 · Due: 2025-07-16
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.