What’s Vulnerable › Vulnerabilities
CVE-2018-9195
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-11-21 · updated 2026-06-17
- Weakness: CWE-798
Description
Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for Windows 6.0.6 and below, FortiOS 6.0.7 and below, FortiClient for Mac OS 6.2.1 and below.
Affected products
- Fortinet FortiClientWindows: through 6.0.6; through 6.2.1
- Fortinet FortiOS (FortiGate): through 6.0.6
References
Get alerted when CVE-2018-9195 or the next vulnerability affects your stack