{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2018-9195",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2018-9195",
    "idYear": 2018,
    "status": "PUBLISHED",
    "publishedAt": "2019-11-21T14:59:52.000Z",
    "updatedAt": "2024-10-25T14:05:09.966Z",
    "importedAt": "2026-10-24T01:56:04.670Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": null,
      "summary": "Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for Windows 6.0.6 and below, FortiOS 6.0.7 and below, FortiClient for Mac OS 6.2.1 and below.",
      "affected": [
        {
          "vendor": "Fortinet",
          "product": "FortiClient for Windows",
          "versions": [
            {
              "version": "FortiClient for Windows 6.0.6 and below",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Fortinet",
          "product": "FortiOS",
          "versions": [
            {
              "version": "FortiOS 6.0.7 and below",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Fortinet",
          "product": "FortiClient for Mac OS",
          "versions": [
            {
              "version": "FortiClient for Mac OS 6.2.1 and below",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}