Is CVE-2019-6693 being actively exploited?

Yes. CVE-2019-6693 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on June 25, 2025.

What is the CVSS score for CVE-2019-6693?

CVE-2019-6693 has a CVSS 3.1 base score of 6.5 (MEDIUM).

CVE-2019-6693

MEDIUM · CVSS 6.5CISA KEV: actively exploitedEPSS 6.6%EU EUVD: exploited

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).

Key facts

CVSS score: 6.5 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-798
EPSS score: 6.6% (94th percentile)
In CISA KEV: Yes, added June 25, 2025
In EU EUVD: Yes (EUVD-2019-16251)
Published: November 21, 2019
NVD last modified: August 4, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

Added to the KEV catalog on June 25, 2025; federal remediation due July 16, 2025. Known to be used in ransomware campaigns.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2019-16251 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on August 4, 2026.

View on the EU Vulnerability Database

Affected products

fortinet / fortios
fortinet / fortios

Certified products that may be affected

4 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

FortiOS 5.6 - Fortinet, Inc. - FIPS 140 3639 - historical
FortiOS 5.2 - Fortinet, Inc. - FIPS 140 2765 - historical
FortiOS™ - Fortinet, Inc. - FIPS 140 1754 - historical
FortiOS - Fortinet, Inc. - FIPS 140 1431 - historical

References

https://fortiguard.com/advisory/FG-IR-19-007(Mitigation, Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6693(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain