CVE-2019-5591: Fortinet FortiOS Default Configuration Vulnerability

Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 18.6% chance of exploitation in the next 30 days.

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.

Affected products

• Fortinet FortiOS: up to and including 6.2.0

Published 2020-08-14. Last modified 2026-08-15.