~/f4n6 $ grep -r "CVE-2025-68686 — Fortinet FortiOS: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" ./investigations/ --include="*.md"

CVE-2025-68686 — Fortinet FortiOS: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Jeff Davies 27 Jul 2026 6 min read

1. Executive summary

CVE-2025-68686 is a MEDIUM-severity (CVSS 5.9, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) exposure of sensitive information vulnerability in Fortinet FortiOS, classified as CWE-200. The flaw permits a remote unauthenticated attacker to bypass an existing patch for a symbolic link persistency mechanism via crafted HTTP requests, but requires the attacker to have already compromised the filesystem via a separate vulnerability. The CVE was added to the CISA Known Exploited Vulnerabilities (KEV) catalogue on 2026-07-27 with active exploitation confirmed; EMEA financial services running affected FortiOS versions should treat this as a post-exploitation persistence risk requiring immediate patching and forensic triage of any previously compromised FortiGate assets.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 24: digital operational resilience testing — general requirements CISA KEV confirms active exploitation of a network-edge security appliance (FortiOS) that functions as a critical ICT asset; the vulnerability enables post-compromise persistence via symlink bypass. Clients must include this CVE in their ICT asset resilience testing programme and conduct forensic triage on exposed FortiGate devices to detect prior filesystem-level compromise.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities Active exploitation is confirmed (CISA KEV, SSVC exploitation = "active"); if forensic triage reveals successful exploitation on a client's FortiGate, this may constitute a major ICT-related incident. Clients must be prepared to classify and report confirmed exploitation under their DORA incident reporting framework, including impact assessment timelines.

3. Technical analysis & attack chain

Affected versions (from NVD)

  • FortiOS 7.6.0 through 7.6.1
  • FortiOS 7.4.0 through 7.4.6
  • FortiOS 7.2 (all versions)
  • FortiOS 7.0 (all versions)
  • FortiOS 6.4 (all versions)

Vulnerability mechanism

CVE-2025-68686 is a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerability in FortiOS. The flaw exists in a symbolic link persistency mechanism that was previously identified in post-exploit scenarios. A patch had been developed to address this symlink-based persistence, but CVE-2025-68686 allows a remote unauthenticated attacker to bypass that patch via crafted HTTP requests.

Confirmed attack chain

  1. Prior compromise (prerequisite): The attacker must first have compromised the FortiOS device at the filesystem level via a separate, unrelated vulnerability. CVE-2025-68686 is not an initial access vector — it is a post-exploitation capability.
  2. Patch bypass via crafted HTTP requests: Once filesystem-level access is achieved, the attacker sends crafted HTTP requests to the FortiOS device that bypass the existing patch for the symbolic link persistency mechanism.
  3. Sensitive information exposure: The bypass enables the attacker to expose sensitive information to an unauthorised actor, maintaining persistence or escalating access despite the prior patch.

CVSS vector analysis: The CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network-based attack vector with high access complexity (reflecting the prerequisite of prior filesystem compromise), no privileges or user interaction required, and confidentiality impact only (no integrity or availability impact). The CVSS 4.0 assessment has not yet been provided by NVD.

SSVC trajectory: CISA's SSVC record shows the exploitation state changed from "none" (assessed 2026-02-11) to "active" (assessed 2026-07-27), confirming that exploitation activity was observed between February and July 2026. The automatable rating is "no" and technical impact is "partial."

Related advisory — context only: A GitHub Security Advisory (GHSA-c5vf-25hf-3m74) describes a separate CWE-266 incorrect privilege assignment vulnerability in FortiOS Security Fabric affecting overlapping version ranges (7.6.0–7.6.2, 7.4.0–7.4.7, 7.2/7.0/6.4 all versions), permitting a remote authenticated attacker with high privileges to escalate to super-admin via registration to a malicious FortiManager. This is a distinct CVE and is referenced for situational awareness only — it is not CVE-2025-68686 and should not be conflated with it.

CISA KEV remediation due date: 2026-08-10 (per CISA KEV entry).

Confidence caveat: The technical mechanism description (symlink persistency bypass via crafted HTTP requests) is sourced from the NVD entry, which attributes the description to Fortinet, Inc. No additional vendor advisory (FG-IR) was available in the provided source material to corroborate further exploitation detail or provide specific IOCs. The CISA KEV listing corroborates active exploitation but provides no campaign or actor attribution.

4. Mitigation & containment

P1 — Within 24 hours

  1. Inventory and exposure assessment: Identify all FortiGate/FortiOS appliances running affected versions (7.6.0–7.6.1, 7.4.0–7.4.6, 7.2.x, 7.0.x, 6.4.x). Prioritise internet-facing devices.
  2. Forensic triage: For any FortiGate device with a known or suspected prior compromise (especially those that were exploited via earlier FortiOS CVEs and subsequently patched), conduct filesystem-level forensic analysis to detect symbolic link persistence artifacts. CISA's KEV entry explicitly references "Forensics Triage Requirements" — follow that guidance.
  3. Network containment: If prior compromise is suspected on any device, isolate the affected FortiGate from management networks and restrict HTTP/HTTPS administrative access to trusted management IPs only. Do not assume prior patching resolves the persistence mechanism — CVE-2025-68686 bypasses that patch.

P2 — Within 72 hours

  1. Apply vendor patch: Upgrade FortiOS to a version that remediates CVE-2025-68686. Consult Fortinet's PSIRT advisory for the specific fixed versions (not available in provided source material — verify directly with Fortinet). The CISA KEV due date is 2026-08-10.
  2. Review administrative access logs: Examine HTTP/HTTPS access logs on all affected FortiGate devices for anomalous or crafted requests that may indicate exploitation of the symlink bypass. Focus on requests from unauthenticated sources targeting administrative interfaces.
  3. Validate FortiManager registrations: Given the related GHSA-c5vf-25hf-3m74 advisory on malicious FortiManager registration, verify that all FortiGate devices are registered only to legitimate, known FortiManager instances.

P3 — Within 7 days

  1. Harden management plane: Disable HTTP/HTTPS administrative access on all non-management interfaces. Enforce administrative access via VPN or dedicated management VLAN.
  2. Patch the related CWE-266 vulnerability: If running FortiOS Security Fabric on affected versions (7.6.0–7.6.2, 7.4.0–7.4.7, 7.2/7.0/6.4), apply the vendor fix for the privilege escalation via malicious FortiManager registration as a defence-in-depth measure.
  3. Update EDR/NDR coverage: Deploy detection rules (see §6) to alert on anomalous symlink creation or unexpected HTTP requests targeting FortiOS administrative interfaces.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

Behaviour Where to observe Confidence
Crafted HTTP requests targeting FortiOS administrative interface (post-compromise) FortiGate HTTP/HTTPS access logs; network firewall logs on management VLAN Medium — consistent with described mechanism but no specific request patterns provided
Symbolic link creation on FortiOS filesystem (persistence artifact) FortiGate filesystem integrity monitoring; forensic disk analysis Medium — described as the persistency mechanism being bypassed; no specific paths provided
Unauthenticated HTTP requests to FortiGate from unexpected source IPs FortiGate traffic logs; SIEM correlated with asset inventory Low — generic; no specific IOCs in source

6. Detection

Insufficient indicators to author detection rules.

The source material describes the vulnerability mechanism (crafted HTTP requests bypassing a symlink persistency patch) but provides no specific artefacts — no file paths, no symlink targets, no HTTP request patterns, no user-agent strings, no mutex names, no registry keys, and no file hashes. YARA and Sigma rules cannot be authored without threat artefacts; any rule built from the available text would detect reporting about the vulnerability, not exploitation of it.

  • Monitor FortiGate HTTP/HTTPS administrative access logs for unauthenticated requests from non-management IP ranges.
  • Deploy filesystem integrity monitoring on FortiGate appliances to detect symbolic link creation in system directories.
  • Correlate FortiGate compromise indicators from prior FortiOS CVEs with subsequent anomalous administrative HTTP requests — the chained nature of this vulnerability (prior filesystem compromise required) makes temporal correlation the strongest detection signal.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

CVE CVSS Exploited EPSS Summary
CVE-2025-68686 5.9 Medium ⚠ KEV 2026-07-27 0% An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 t…

7. Sources

  • NVD, "CVE-2025-68686 — Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability," https://nvd.nist.gov/vuln/detail/CVE-2025-68686, published 2026-07-26
  • CISA, "Known Exploited Vulnerabilities Catalog — CVE-2025-68686," https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686, added 2026-07-27
  • GitHub Security Advisories, "GHSA-c5vf-25hf-3m74 — Incorrect privilege assignment in FortiOS Security Fabric," https://github.com/advisories/GHSA-c5vf-25hf-3m74 (related context only)

8. Adverse Trace position

CVE-2025-68686 is a MEDIUM-severity (CVSS 5.9) post-exploitation vulnerability with confirmed active exploitation in the wild (CISA KEV, added 2026-07-27). The requirement for prior filesystem-level compromise via a separate vulnerability limits the blast radius but significantly raises the stakes for any EMEA financial services client that has experienced a prior FortiOS compromise — the symlink persistence bypass means previously "remediated" devices may still harbour active persistence. The CISA KEV due date of 2026-08-10 provides a hard deadline for mitigation. Clients should prioritise forensic triage of any FortiGate with a compromise history over blanket patching of unaffected devices, though both are required. No threat actor attribution is available in the source material; the exploitation is unattributed. Adverse Trace will monitor for Fortinet PSIRT advisory publication and any emerging IOCs or campaign reporting, and will update this advisory if a fixed version is confirmed or exploitation artefacts become available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies