CVE-2025-68686 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-02-10

Added to CISA KEV: 2026-07-27 167 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation. Because exploitation requires a PRIOR compromise, treat any affected device as potentially breached: hunt for symbolic-link persistence artifacts, unauthorized filesystem/root read access, anomalous SSL-VPN sessions, and configuration/credential exfiltration.
Immediately upgrade to FortiOS 7.6.2+ or 7.4.7+ (and follow Fortinet FG-IR-25-934 guidance for 7.2/7.0/6.4 branches). If a device may have been previously compromised, rotate all secrets (VPN creds, local accounts, certificates, pre-shared keys) and consider a full factory reset/reflash after patching.
Restrict management and SSL-VPN interfaces to trusted IPs/VPN, disable internet-exposed admin access, enable MFA, and monitor HTTP request logs for double-slash / path-traversal style requests and unexpected filesystem access.
Patch priority: HIGH/URGENT — despite the MEDIUM CVSS, KEV listing plus its role in defeating remediation of prior FortiGate compromises warrants emergency patching and IoC review.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2025-68686 is an Exposure of Sensitive Information vulnerability (CWE-200) affecting Fortinet FortiOS that enables a remote, unauthenticated attacker to bypass a previously deployed security patch ^[5]^[6]. Specifically, the vulnerability allows attackers to circumvent a fix intended to prevent symbolic link persistency, which had been observed in earlier post-exploitation scenarios ^[2]. This vulnerability matters because it restores unauthorized read-only access to the root filesystem on devices that were previously compromised, effectively undermining remediation efforts ^[3].

Exploitation

Active Exploitation: The vulnerability is actively exploited in the wild, leading to its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Threat Actors: While specific ransomware campaigns or actors were not detailed in the retrieved results, the nature of the exploit suggests its use by advanced actors focusing on persistence and data exfiltration on compromised network appliances.
Proof-of-Concept: PoC code is available and leverages a "double slash" technique to bypass the existing patch ^[1]^[3].
Prerequisites: The attack is network-based and does not require local access or authentication; however, it often requires a device to have been previously compromised through another vulnerability to establish the necessary conditions for the persistence mechanism ^[1].

Affected Products & Patches

Affected Versions: Fortinet FortiOS 6.4 (all), 7.0 (all), 7.2 (all), 7.4.0 through 7.4.6, and 7.6.0 through 7.6.1 ^[2].
Patch/Hotfix: Users are advised to apply the latest security patches released by Fortinet for their respective versions.
Mitigations: In addition to patching, organizations should monitor systems for signs of post-exploitation activity, specifically unauthorized access to the filesystem, and consult official Fortinet PSIRT advisories for specific remediation steps.

Impact

Access/Capability: Successful exploitation grants an attacker unauthorized read-only access to the root filesystem, facilitating the retrieval of sensitive information ^[3]^[4].
Business Risk: For internet-facing deployments, the primary risk is that attackers can maintain persistence on critical security infrastructure, leading to data breaches, exfiltration of configuration secrets, and the subversion of internal network security controls.

Sources

CVE-2025-68686 - IPBUF
# CVE-2025-68686 PoC - FortiOS Symbolic Link Bypass # Note: Requires prior compromise via another vulnerability import requests import ssl import urllib3 urllib3 ...
CVE-2025-68686 - Vulnerability Details - OpenCVE
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass…
Bypassing the FortiGate Symlink Patch - Labs at ITRES
link Patch: The Double Slash Technique (CVE-2025-68686) This effectively bypasses the patch, restoring unauthorized read-only access to the root filesystem.
CVE-2025-68686: Fortinet FortiOS Information Disclosure
CVE-2025-68686 is an information disclosure vulnerability in Fortinet FortiOS that exposes sensitive data to unauthorized actors through crafted HTTP requests. This article covers technical details, affected versions, and mitigation. ... CVE-2025-68686 is an information disclosure vulnerability in F…
NVD-CVE-2025-68686
Quick Info CVE Dictionary Entry: CVE-2025-68686 NVD Published Date: Feb 10, 2026 NVD Last Modified: Jul 28, 2026 Source: Fortinet, Inc. ... Description. An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 ...

🟡 CVE-2025-68686