Is CVE-2019-6693 (Fortinet FortiOS Use of Hard-Coded Credentials) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2019-6693 to its Known Exploited Vulnerabilities catalogue on 25 June 2025, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.

What CVE-2019-6693 Means for FortiOS Exposure

This is not just a product defect to track in a feed. The practical question is whether any FortiOS instance, backup workflow, or administrative path could still expose the hard-coded credential path described in the advisory. For internet-facing appliances, the first task is to confirm which devices, backups, and management interfaces are in scope, then correlate that with the exploitability signalled by KEV.

The issue matters because hard-coded credentials collapse a key trust assumption: if the secret is known or recoverable, the confidentiality of configuration backups and related administrative material can fail even when perimeter access looks normal. That makes inventory and exposure review more important than a simple version check alone.

FortiOS belongs in the same operational category as other edge and appliance security problems where management exposure and device hardening are central, which is why NHIMG’s Edge Device Security Guide is a useful companion for identifying exposed management paths and weak appliance assumptions.

How to Respond When Patching or Mitigation Is Delayed

If remediation cannot happen immediately, reduce the blast radius around any FortiOS backup material and administrative access paths. Treat configuration backups as sensitive assets, review where they are stored and who can retrieve them, and disable unnecessary exposure of management services until the vulnerable instance is corrected.

Hard-coded credential issues usually become materially worse when secret handling is weak around backups, scripts, or automated admin processes. The same failure pattern appears in broader secrets sprawl, so use the practical guidance in the Guide to the Secret Sprawl Challenge to think about hard-coded credentials, exposure points, and remediation sequencing.

When delay is unavoidable, focus on containment first: restrict access to the affected backups, review whether the appliance or its stored configuration can be reached by untrusted users, and preserve evidence for later validation. If the device is externally exposed, treat that as a higher-priority case than an isolated internal appliance.

What Practitioners Should Check After Exposure Is Confirmed

Once exposure is confirmed, the next step is to assume that any protected data in the configuration backup may have been at risk and to look for signs of access to backup repositories, admin interfaces, or supporting scripts. For a CVE that is already in KEV and linked to ransomware, post-exposure validation should not wait for a clean bill of health from the device itself.

That review should include whether the vulnerable instance participated in configuration export, backup automation, or remote administration workflows that reused the same secret material. If those workflows exist, rotate the relevant credentials and invalidate any sessions or access paths that depended on the exposed material.

Rotation is often the right next move for appliance-related secrets, and NHIMG’s Guide to NHI Rotation Challenges helps frame the operational issue of replacing credentials without breaking dependent services or leaving long-lived secrets in place.

Risk and Threat Considerations

Hard-coded credentials create a direct attack path because they can survive normal password governance, and once they are known or inferred, an attacker may be able to decrypt or misuse sensitive configuration data. In an appliance context, that can turn a single exposed secret into broader administrative and data exposure.

Failure mechanism: the device or its backup process relies on a secret embedded in software rather than a separately managed credential, so compromise of the secret defeats the protection of the backup content and may enable follow-on access to administrative material.

Impact: attackers can potentially read, decrypt, or abuse configuration backup data, which may expose credentials, network details, and access paths that support deeper compromise or ransomware activity.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10, MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-5 — Account Management	Hard-coded credentials and exposed appliance access are account-management failures.
Recommendation — Review and remove any embedded appliance credentials, then rotate and retire the affected access paths.
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	The issue centers on embedded credentials and their lifecycle, including rotation and revocation.
	IA-9 — Service Identification and Authentication	FortiOS backup and admin workflows may rely on non-human authentication material.
Recommendation — Rotate compromised authenticators and replace hard-coded secrets with managed credential lifecycle controls. Require managed non-human authentication instead of embedded appliance secrets.
OWASP Non-Human Identity Top 10	NHI-02 — Secret Leakage	Hard-coded credentials are a direct secret leakage pattern.
	NHI-07 — Long-Lived Secrets	Hard-coded credentials are effectively long-lived secrets with poor revocation characteristics.
Recommendation — Eliminate embedded secrets and move them into managed secret storage. Replace static appliance secrets with expiring credentials and enforced rotation.
MITRE ATT&CK	T1552 — Unsecured Credentials	The vulnerability exposes credentials that can be discovered or abused by an attacker.
Recommendation — Hunt for exposed credentials and map where they could support later access.
OWASP API Security Top 10	API2 — Broken Authentication	If exposed admin or API access relies on hard-coded credentials, authentication is fundamentally weakened.
Recommendation — Replace weak embedded authentication with stronger, centrally managed authentication controls.

Practitioner Guidance

What to prioritise: Confirm whether the FortiOS instance is internet-facing, whether configuration backups exist, and whether any backup or restore workflow still depends on the vulnerable appliance. If yes, treat that combination as the highest-risk operational case.

What to verify: Validate that the hard-coded credential path is no longer reachable in your environment, that backup storage is access-controlled, and that any secrets embedded in adjacent automation or administration tooling have been rotated or replaced.

Decision rule: If the appliance or its backups are used for privileged administration, rotate related credentials first and investigate compromise second; for lower-trust internal deployments, still verify backup exposure before assuming the risk is limited.

Practitioner takeaway: For exploited appliance flaws, the right question is not only whether a patch exists, but whether the secret exposure has already widened the blast radius beyond the vulnerable box itself.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org