Fortinet FortiOS Default Configuration Vulnerability
- Severity
- Medium6.5CVSS 3.1, Medium
- Known exploited
- Known exploitedFederal remediation due date: 3 May 2022
- Exploit prediction
- 18%
- Published
- 14 Aug 2020Updated 15 Aug 2026 · Last verified 29 Sept 2026
Description
Title, description and vendor guidance are quoted from the source records.
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
Weakness: CWE-306
Known exploited
Added to CISA KEV on 3 Nov 2021
Federal remediation due date: 3 May 2022
Known use in ransomware campaigns
Required action: Apply updates per vendor instructions.
Exploit prediction
18% probability of exploitation in the next 30 days (percentile 97%).
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Patcharo shows this vulnerability for information but does not match versions for this product yet.
- Fortinet Fortinet FortiOS · FortiOS 6.2.0 and below.
References
Provenance
Every fact on this page comes from the sources below. Nothing is written by an AI.
- Fortinet (CVE record)
- Fortinet (CVE record) · 29 Sept 2026 at 15:17 UTC · Parser patcharo-cve5/1.1.0
- CISA Known Exploited Vulnerabilities
- CISA Known Exploited Vulnerabilities · 29 Sept 2026 at 15:17 UTC · Parser patcharo-kev/1.0.0
- NVD
- NVD · 27 Sept 2026 at 23:44 UTC · Parser patcharo-nvd/1.0.0
- FIRST EPSS
- FIRST EPSS · 30 Sept 2026 at 00:17 UTC · Parser patcharo-epss/1.0.0
Last verified: 29 Sept 2026 at 15:17 UTC