The vulnerability exists in Fortinet FortiOS versions up to 7.6.6. It allows an attacker who has access to the device's configuration files to decrypt LDAP credentials, exposing administrators' usernames and passwords. The weakness arises because the default encryption key is identical for all customers. Attackers could then use these credentials to access unauthorized services or compromise the FortiGate device.

All FortiGate devices running FortiOS 7.6.6 or earlier are potentially impacted. The affected product is Fortinet FortiOS, as identified by the vendor/product CPE string. No specific device models are listed, so the risk applies broadly to any FortiGate appliance storing configuration data in the standard format.

The CVSS score of 3.2 indicates a low severity, but the vulnerability has been actively exploited in the wild from December 2025 through 2026. EPSS is less than 1%, suggesting a very low probability of exploitation, yet real-world activity contradicts that low statistical likelihood. Likely attackers already possess read access to the configuration files—through local or remotely misconfigured management interfaces—and then leverage the default key to recover LDAP credentials. The weakness is classified as CWE-1394, a cryptographic issue involving key management. The vulnerability is not listed in the CISA KEV catalog.