---
id: "CVE-2019-6693"
kind: "vulnerability"
aliases: ["CVE-2019-6693"]
title: "fortinet fortios: Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an\u2026"
severity: "high"
cvss: 6.5
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Fortinet FortiOS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": "<= 5.6.10", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 6.0.0, <= 6.0.6", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": "= 6.2.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "fortinet", "fortios", "infrastructure", "ransomware", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2019-11-21T16:15:13+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6693", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6693", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# fortinet fortios: Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an…

Fortinet FortiOS contains a hard-coded cryptographic key used to encrypt configuration backup files. An attacker who knows the key can decrypt a backup and read sensitive data stored in it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Fortinet FortiOS affected ? fixed ?
- vendor:fortinet fortios affected <= 5.6.10 fixed ?
- vendor:fortinet fortios affected >= 6.0.0, <= 6.0.6 fixed ?
- vendor:fortinet fortios affected = 6.2.0 fixed ?

## Fix

Apply the mitigation per Fortinet's vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action). Affected and fixed versions: unknown

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6693
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-6693

## From the sources

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_