CVE-2026-25815
LDAP Credential Decryption in Fortinet FortiOS Configuration Files
Publication date: 2026-02-05
Last updated on: 2026-02-05
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fortinet | fortios | to 7.6.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1394 | The product uses a default cryptographic key for potentially critical functionality. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Fortinet FortiOS versions up to 7.6.6 and allows attackers to decrypt LDAP credentials stored in device configuration files. The issue arises because the encryption key used to protect these credentials is the same across all customer installations by default. Although there is a non-default option to enable stronger encryption, it is not enabled by default due to potential disruptions in functionality.
How can this vulnerability impact me? :
An attacker who exploits this vulnerability can decrypt LDAP credentials stored in the device configuration files. This could lead to unauthorized access to LDAP services, potentially exposing sensitive authentication information. Since the encryption key is shared across installations by default, multiple customers could be affected if an attacker obtains the key.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability arises because Fortinet FortiOS through version 7.6.6 uses the same encryption key across all customers by default to encrypt LDAP credentials in device configuration files.
To mitigate this vulnerability, customers should enable the non-default option that eliminates this weakness by using private data encryption with a unique key per installation.
However, enabling this option may disrupt functionality as noted in Fortinet's documentation on managing FortiGates with private data encryption.
Therefore, the immediate step is to evaluate enabling this non-default private data encryption option despite potential disruptions, to prevent attackers from decrypting LDAP credentials.