Fortinet FortiOS Default Configuration Vulnerability
- Severity
- Medium6.5CVSS 3.1, Medium
- EPSS
- 18%
- Published
- 14 Aug 2020
- Updated
- 15 Aug 2026
Description
Title, description and vendor guidance are quoted from the source records.
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
Weakness: CWE-306
Known exploited
Added to CISA KEV on 3 Nov 2021
Federal remediation due date: 3 May 2022
Known use in ransomware campaigns
Required action: Apply updates per vendor instructions.
Exploit prediction
18% probability of exploitation in the next 30 days (percentile 97%).
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Patcharo shows this vulnerability for information but does not match versions for this product yet.
- Fortinet Fortinet FortiOS · FortiOS 6.2.0 and below.
References
Provenance
Every fact on this page comes from the sources below. Nothing is written by an AI.
- Fortinet (CVE record)
- Fortinet (CVE record) · 27 Sept 2026, 23:46 UTC · Parser patcharo-cve5/1.1.0
- CISA Known Exploited Vulnerabilities
- CISA Known Exploited Vulnerabilities · 27 Sept 2026, 23:42 UTC · Parser patcharo-kev/1.0.0
- NVD
- NVD · 27 Sept 2026, 23:44 UTC · Parser patcharo-nvd/1.0.0
- FIRST EPSS
- FIRST EPSS · 27 Sept 2026, 23:46 UTC · Parser patcharo-epss/1.0.0
Last verified: 28 Sept 2026, 02:31 UTC