CVE-2026-25815
CVE-2026-25815 is a low-severity vulnerability with a CVSS 3.x base score of 3.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1394.
Key facts
- Severity: Low (CVSS 3.x base score 3.2)
- EPSS exploit prediction: 0% (1st percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-5525
- Weakness: CWE-1394
- Published:
- Last modified:
Description
Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 through 2026 (by default, the encryption key is the same across all customers' installations). NOTE: the Supplier's position is that the instance of CWE-1394 is not a vulnerability because customers "are supposed to enable" a non-default option that eliminates the weakness. However, that non-default option can disrupt functionality as shown in the "Managing FortiGates with private data encryption" document, and is therefore intentionally not a default option.
Frequently asked questions
- What is CVE-2026-25815?
- Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 through 2026 (by default, the encryption key is the same across all customers' installations). NOTE: the Supplier's position is that the instance of CWE-1394 is not a vulnerability because customers "are supposed to enable" a non-default option that eliminates the weakness. However, that non-default option can disrupt functionality as shown in the "Managing FortiGates with private data encryption" document, and is therefore intentionally not a default option.
- How severe is CVE-2026-25815?
- CVE-2026-25815 has a CVSS 3.x base score of 3.2, rated low severity. It is exploitable over local access with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
- Is CVE-2026-25815 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (1st percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-25815?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-25815 have an EU (EUVD) identifier?
- Yes. CVE-2026-25815 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-5525.
- When was CVE-2026-25815 published?
- CVE-2026-25815 was published on 2026-02-05 and last updated on 2026-06-17.
References
- https://docs.fortinet.com/document/fortimanager/7.6.6/administration-guide/30332/managing-fortigates-with-private-data-encryption
- https://www.cert.at/en/blog/2026/1/threat-actors-use-forticloud-to-collect-ldap-connection-passwords
Other CWE-1394 vulnerabilities
- CVE-2025-41742 — Critical (CVSS 9.8): Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote…
- CVE-2024-48956 — Critical (CVSS 9.8): Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially…
- CVE-2025-41744 — Critical (CVSS 9.1): Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to…
- CVE-2025-55049 — Critical (CVSS 9.1): Use of Default Cryptographic Key (CWE-1394)
- CVE-2024-1275 — Critical (CVSS 9.1): Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow…
- CVE-2024-29037 — Critical (CVSS 9.1): datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster.…