CVE-2025-68686

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-68686 5.9

Fortinet · FortiOS · Added 2026-07-27 · Published 2026-02-10

KEV Active Exploitation

Details

VulnerabilityFortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

VendorFortinet

ProductFortiOS

Date added2026-07-27

Due date2026-08-10

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-200

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Descriptions

KEV: Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

NVD: An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

Compliance SSVC + BOD 26-04

Automatableno

Technical impactpartial

Exploitation statusactive

3-day qualifyingNo

Public timeline14 days

Non-public timeline14 days

Forensic (public)Not required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-25 21:14 UTC

Searches4

Component defaultno

Sources https://fortiguard.fortinet.com/psirt/FG-IR-25-934
https://www.fortiguard.com/psirt?cve=CVE-2025-68686
https://nvd.nist.gov/vuln/detail/CVE-2025-68686
https://www.sentinelone.com/vulnerability-database/cve-2025-68686/
https://securityarsenal.com/blog/cve-2025-68686-fortinet-fortios-symlink-bypass-detection-and-remediation
https://cybersecuritystash.com/news/fortios-cve-2025-68686-kev-ssl-vpn-symlink-persistence-triage

Hunting hypothesis agent

Hunt for unusual HTTP requests to the FortiGate SSL-VPN web interface with URI paths or parameters deviating from normal VPN login flows, especially after prior indicators of FortiGate compromise.

Research details

ComponentSSL-VPN web management interface — symlink persistence patch bypass via crafted HTTP requests to SSL-VPN endpoints

PreconditionsThe target FortiGate must be running FortiOS 7.6.0–7.6.1, 7.4.0–7.4.6, 7.2 (all versions), 7.0 (all versions), or 6.4 (all versions); the SSL-VPN service must be enabled and accessible (network reachability to the SSL-VPN web interface on the configured port, typically 443); the attacker must have already compromised the device at filesystem level through a separate vulnerability (prior exploitation required); the vulnerability then allows bypassing the symlink persistency patch via crafted unauthenticated HTTP requests to re-establish persistence. agent

DeliveryCrafted HTTP requests to the SSL-VPN web interface (post-exploitation, requires prior filesystem-level compromise)

Public PoCno

Advisoryhttps://fortiguard.fortinet.com/psirt/FG-IR-25-934

Exploit notesNo public proof-of-concept available. Post-exploitation patch bypass only — requires prior filesystem-level compromise through a separate vulnerability. CVSS attack complexity: HIGH. CVSS 5.9 MEDIUM. Exploitation status is active per CISA KEV (added 2026-07-27), indicating in-the-wild use despite no public PoC.

SummaryFortinet FortiOS versions 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 (all), 7.0 (all), and 6.4 (all) contain an information disclosure vulnerability (CWE-200) allowing a remote unauthenticated attacker to bypass the patch for the symbolic link persistency mechanism observed in FortiGate post-exploit activity. The bypass is triggered via crafted HTTP requests to the SSL-VPN web interface, but requires prior filesystem-level compromise through a separate vulnerability. No public PoC exists; FortiOS 7.4.7, 7.6.2, and later contain the fix. CVSS 5.9 MEDIUM; CISA added to KEV on 2026-07-27 with a 2026-08-10 remediation deadline.

Tia coverage

First reported2026-07-28

First exploit report2026-07-28

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-adds-two-exploited-vulnerabilities-to-kev-arista-velocloud

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.