CVE-2016-1909

CRITICAL ⚠ Exploit

Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17...

Affects 1 product across 1 vendor.

CVSS 3.09.8
EPSS71.3%
Percentile99th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-264: Permissions, Privileges, and Access Controls

Broad class covering failures in permission enforcement. Deprecated in favor of CWE-284, CWE-862, CWE-863.

◆ AI Analysis — automated analysis, not human-reviewed

A hardcoded passphrase vulnerability in Fortinet products allows remote attackers to gain administrative access via SSH.

BSID: BS-2016-GLOBAL-158959-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2016-1909?
A hardcoded passphrase vulnerability in Fortinet products allows remote attackers to gain administrative access via SSH.
What is the CVSS score for CVE-2016-1909?
CVE-2016-1909 has CVSS 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 71.3%.
Is CVE-2016-1909 actively exploited?
Public exploit available for CVE-2016-1909. Exploitation risk elevated.
How do I remediate CVE-2016-1909?
Priority: IMMEDIATE.
What systems are affected by CVE-2016-1909?
CVE-2016-1909 affects Fortinet Fortios.
Vulnerability Details
CVE IDCVE-2016-1909
BSIDBS-2016-GLOBAL-158959-C BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2016-01-15
Last Modified2026-06-17
ICS Relevance55%
Weakness (CWE)
Permissions, Privileges, and Access Controls
Domains
NETWORK-INFRA
SourceNVD
Official Description

Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access account, which allows remote attackers to obtain administrative access via an SSH session.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability exists due to a hardcoded passphrase for the Fortimanager_Access account in FortiAnalyzer, FortiSwitch, FortiCache, and FortiOS versions prior to specified updates. Attackers can exploit this by initiating an SSH session with the hardcoded credentials.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Fortinet Fortios 5.0 5.0.0 5.0.1 5.0.2 5.0.3 5.0.4
+4 more5.0.5 5.0.6 5.0.7 ≤ 4.3.16
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 3930 Days
CISA known-exploitedNot in KEV catalog
Public Exploit⚠ Available — Reference
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
Related CVEs affecting Fortinet
CVE-2005-3057 10.0 The FTP component in FortiGate 2.8 running FortiOS 2.8MR10 and v3beta, and ot... CVE-2026-26084 9.9 A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 throug... CVE-2026-104286 9.8 An improper limitation of a pathname to a restricted directory ('path travers... CVE-2025-64446 9.8 A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.... CVE-2025-25257 9.8 An improper neutralization of special elements used in an SQL command ('SQL I...
View all Fortinet CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →