CVE-2016-1909: Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0...

Security readout for executives and security teams

Older Fortinet management and network security products contain a built-in account with a hardcoded passphrase. If SSH management is reachable, a remote attacker could gain administrative access. This is a high-impact legacy exposure, especially for internet-facing management interfaces or forgotten appliances. Exposure is most likely where affected Fortinet devices still run the listed legacy versions and expose SSH management to untrusted networks. Internal-only SSH remains risky if attackers gain network foothold. Treat this as urgent for any still-deployed legacy Fortinet device. Administrative compromise of security infrastructure can undermine network controls, logging, and downstream incident response. Mitigation focus: Upgrade affected FortiAnalyzer versions to 5.0.12, 5.2.5, or later supported releases.; Upgrade affected FortiSwitch versions to 3.3.3 or later supported releases.; Upgrade affected FortiCache versions to 3.0.8 or later supported releases..

Prepared

Jun 13, 2026, 21:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.