PT-2026-6632 · Fortinet · Fortios

Published 2026-02-05 · Updated 2026-02-06 · CVE-2026-25815

Positive Technologies (AI Summary)

CVSS v3.1

3.2

Low

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions through 7.6.6

Description Fortinet FortiOS through version 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files. This issue was exploited in the wild between December 16, 2025, and 2026. The default encryption key is the same across all customer installations, facilitating decryption.

Recommendations Versions prior to 7.6.7 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1394

Related Identifiers

CVE-2026-25815

Affected Products

Fortios

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-25815 · Security Note
• https://twitter.com/VulmonFeeds/status/2019620975126495574 · Twitter Post
• https://docs.fortinet.com/document/fortimanager/7.6.6/administration-guide/30332/managing-fortigates-with-private-data-encryption · Note
• https://cert.at/en/blog/2026/1/threat-actors-use-forticloud-to-collect-ldap-connection-passwords · Note
• https://t.me/CVEtracker/43871 · Telegram Post
• https://twitter.com/0dayPublishing/status/2019523051331723407 · Twitter Post
• https://t.me/cveNotify/151063 · Telegram Post
• https://twitter.com/CVEnew/status/2019524719536480272 · Twitter Post