CVE-2019-6695

CRITICAL

Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image th...

Affects 2 products across 1 vendor.

CVSS 3.19.8
EPSS0.8%
Percentile55th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-345: CWE-345
Related Attack Patterns (CAPEC)
CAPEC-142 DNS Cache Poisoning
via CWE-345
CAPEC-218 Spoofing of UDDI/ebXML Messages
via CWE-345
CAPEC-385 Transaction or Event Tampering via Application API Manipulation
via CWE-345
CAPEC-387 Navigation Remapping To Propagate Malicious Content
via CWE-345
CAPEC-388 Application API Button Hijacking
via CWE-345
Show all 12

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2019. A critical vulnerability affects Fortinet systems (CVE-2019-6695). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2019-GLOBAL-205509-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2019-6695?
This vulnerability was disclosed in 2019. A critical vulnerability affects Fortinet systems (CVE-2019-6695). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2019-6695?
CVE-2019-6695 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.8%.
Is CVE-2019-6695 actively exploited?
No confirmed active exploitation of CVE-2019-6695 as of 2026-09-25.
How do I remediate CVE-2019-6695?
Priority: MEDIUM. PSIRT: [email protected]
What systems are affected by CVE-2019-6695?
CVE-2019-6695 affects Fortinet Fortimanager.
Vulnerability Details
CVE IDCVE-2019-6695
BSIDBS-2019-GLOBAL-205509-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2019-08-23
Last Modified2026-06-17
ICS Relevance55%
Weakness (CWE)
CWE-345
Domains
NETWORK-INFRA
SourceNVD
Official Description

Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Exploitation Likelihood: LOW

Affected Products
VendorProductAffected Versions
Fortinet Fortimanager (device & firmware) 6.2.0 ≤ 6.0.6
Remediation

No official vendor advisory link on record. See the CVE record →

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2610 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash73f2dc3203c02237902a43ac7cc1c421adbbd7c7e47a4107f435a95c7bbea13b2aed3750992047cfed92f5e60ecf4c0fb518775bdb3491365fc0ac42c044852b
Related CVEs affecting Fortinet
CVE-2005-3057 10.0 The FTP component in FortiGate 2.8 running FortiOS 2.8MR10 and v3beta, and ot... CVE-2026-26084 9.9 A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 throug... CVE-2018-1352 9.8 A format string vulnerability in Fortinet FortiOS 5.6.0 allows attacker to ex... CVE-2015-3616 9.8 SQL injection vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2... CVE-2016-6909 9.8 Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4...
View all Fortinet CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →