CVE-2019-6693VulnerabilityPublished 06/25/2025Updated 10/24/2026
CVE-2019-6693: Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
Affects Fortinet FortiOSSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 06/25/2025
- KEV deadline
- 07/16/2025
- Ransomware
- Used in ransomware campaigns
- EPSS
- 6.6% chance of exploitation in 30 days – higher than 93% of CVEs
What to do
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.