CVE-2019-5592: Fortinet FortiOS Ips Engine

Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days.

Multiple padding oracle vulnerabilities (Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length) in the CBC padding implementation of FortiOS IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below, when configured with SSL Deep Inspection policies and with the IPS sensor enabled, may allow an attacker to decipher TLS connections going through the FortiGate via monitoring the traffic in a Man-in-the-middle position.

Affected products

• Fortinet FortiOS Ips Engine: up to and including 3.00547; from 4.00000, up to and including 4.00036; from 4.00200, up to and including 4.00219; from 5.00000, up to and including 5.00006

Published 2019-08-23. Last modified 2026-06-17.