CVE-2016-1909: Fortinet FortiGate and FortiManager hardcoded SSH passphrase grants admin access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8, public exploit code, and a very high EPSS score make this an urgent remote administrative compromise risk for unpatched Fortinet devices.

What it is

Multiple Fortinet products (FortiAnalyzer, FortiSwitch, FortiCache, FortiOS) contain a hardcoded passphrase for the Fortimanager_Access account. An attacker who knows this passphrase can log in over SSH and obtain administrative access to the affected device. The flaw affects a broad set of Fortinet management and security appliances, making it a serious exposure for any unpatched deployment.

Impact

A remote attacker gains full administrative control of the affected Fortinet device, including the ability to change configuration, access sensitive data, and pivot into the managed network. This is equivalent to a complete compromise of the appliance.

Attack surface

The vulnerability is reachable over the network via SSH; no authentication is required because the attacker uses the hardcoded passphrase. No user interaction is needed, as shown by the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Public exploit code exists (Exploit-DB, Packet Storm, Full Disclosure references tagged Exploit), and EPSS indicates a high probability of exploitation (0.71268, 99.379th percentile). The CVE is not listed in CISA KEV.

What to do

• Apply the vendor patches: upgrade FortiAnalyzer to 5.0.12 or 5.2.5, FortiSwitch to 3.3.3, FortiCache to 3.0.8, and FortiOS to 4.1.11, 4.2.16, 4.3.17, or 5.0.8 as applicable.
• If immediate patching is not possible, restrict SSH access to trusted management networks and disable SSH on internet-facing interfaces.
• Change or disable the Fortimanager_Access account if the product allows it, and audit for any unauthorized use of that account.
• Monitor Fortinet advisories and apply any additional vendor guidance for the affected product lines.

Detection

• Search SSH authentication logs for successful logins using the Fortimanager_Access account, especially from unexpected source IPs.
• Monitor for SSH connections to Fortinet management interfaces from external or untrusted networks.
• Audit device configurations for the presence of the Fortimanager_Access account and verify it is not enabled or accessible.
• Use network flow or IDS signatures to detect SSH sessions to Fortinet devices that originate from non-management subnets.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.