CVE-2025-68686
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Description
CVE-2025-68686 is an exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiOS that lets a remote, unauthenticated attacker bypass the patch Fortinet developed against the symbolic link persistency mechanism seen in earlier post-exploitation cases. By sending crafted HTTP requests, an attacker can regain read access to sensitive data through a symlink that was planted on the filesystem during a previous compromise, which is why exploitation of this FortiOS vulnerability presupposes that the device was already compromised at filesystem level through another flaw. Rated CVSS 5.9 (Medium) with high attack complexity and a high confidentiality impact, CVE-2025-68686 matters less as an initial entry point and more as a persistence and data-exfiltration path that survives the original fix. CISA added CVE-2025-68686 to its Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of 2026-08-10, confirming active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortios | >= 6.4.0, < 7.4.7; >= 7.6.0, < 7.6.2 |
References
- https://fortiguard.fortinet.com/psirt/FG-IR-25-934(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686(US Government Resource)
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor occurs when a product discloses sensitive information to parties who should not have access to it, whether through improper access controls on data stores, side channels, or responses that return more than they should. In FortiOS the incomplete fix for the symbolic link persistency mechanism means that a crafted HTTP request can still reach data behind an attacker-planted symlink, so a remote party without valid credentials can read files that the patch was supposed to place out of reach.
Learn more: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Impact Analysis
CVE-2025-68686 carries a CVSS 3.1 base score of 5.9 (Medium): the vulnerability is remotely exploitable without physical access and requires no authentication and no user action, but the high attack complexity metric reflects a real precondition — the attacker must already have compromised the FortiOS device at filesystem level through a separate vulnerability in order to have a symlink in place. Confidentiality (High): once that precondition is met, the crafted HTTP requests give access to sensitive data on the firewall, which on a FortiOS device can include configuration material and credentials that unlock further movement into the protected network. Integrity and Availability (None): the flaw does not let an attacker modify configuration or take the device offline through this path. The security significance is that a Fortinet customer who applied the earlier symlink patch and considered the incident closed may still be exposed, and because CISA has confirmed exploitation in the wild against a device class that sits at the network perimeter, unpatched FortiOS units should be treated as an active incident rather than a routine patch item.
Exploit Maturity
CVE-2025-68686 is listed in CISA's Known Exploited Vulnerabilities catalog, which confirms active exploitation in the wild; ransomware use is currently marked as Unknown. No public exploit code appears in the available references — the published sources are the Fortinet PSIRT advisory FG-IR-25-934 and the CISA KEV entry — but Fortinet's own description places the technique in observed post-exploitation activity, so the capability exists in the hands of real operators rather than only researchers. The EPSS score of 1.26% (66.8th percentile) is modest, which fits a vulnerability that cannot be used for opportunistic mass exploitation because it requires a prior filesystem compromise. The practical question for defenders is not whether an internet-wide scan will find them but whether their FortiOS device was already breached earlier: if it was, this patch bypass is a live route back in, and both patching and a full compromise assessment are needed before the 2026-08-10 KEV deadline.
Remediation
- Follow the CISA KEV required action: apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 risk-based patching guidance and CISA's Forensics Triage Requirements, and discontinue use of the product if mitigations are unavailable. The KEV due date is 2026-08-10.
- Upgrade FortiOS according to Fortinet advisory FG-IR-25-934. Affected versions run from 6.4.0 up to but not including 7.4.7, and from 7.6.0 up to but not including 7.6.2, so move to FortiOS 7.4.7 or 7.6.2 or later; the 7.2, 7.0, and 6.4 branches are affected in all versions and require migration to a supported fixed train.
- Treat every affected device as potentially already compromised, because exploitation requires prior filesystem-level access. Search the filesystem for unexpected symbolic links, inspect the configuration for unauthorised administrators, VPN users, and automation scripts, and rotate all credentials, certificates, and pre-shared keys stored on the device.
- Restrict administrative and SSL-VPN interfaces to known source addresses, and review HTTP request logs for unusual paths that would indicate attempts to traverse a planted symlink, following CISA's forensic triage guidance for the affected assets.
- As long-term hardening against information exposure (CWE-200), apply least privilege to all data access on the appliance, keep configuration backups and credential material off the device where possible, and verify after each vendor fix that the corresponding indicators of compromise are absent rather than assuming a patch removes an existing foothold.
Technical Details
The mechanism behind CVE-2025-68686 is an incomplete remediation: Fortinet previously shipped a patch against a symbolic link persistency technique that attackers used after compromising FortiOS, and this vulnerability shows that crafted HTTP requests can still traverse that path to disclose sensitive information (CWE-200). Because the exposure works through the device's HTTP interface, the attack arrives over the network with no credentials and no user interaction, matching the AV:N, PR:N, and UI:N metrics in the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The AC:H rating captures the dependency chain rather than payload difficulty: the attacker needs an existing filesystem-level compromise from another vulnerability so that the symlink exists to be followed, which makes CVE-2025-68686 a second-stage weakness in practice. Scope remains unchanged (S:U) and only confidentiality is impacted, at High (C:H), consistent with a read primitive that returns protected files rather than one that alters device state. The affected range spans FortiOS 6.4, 7.0, 7.2, 7.4.0 through 7.4.6, and 7.6.0 through 7.6.1.
Frequently Asked Questions
Is CVE-2025-68686 being actively exploited?
Yes. CVE-2025-68686 is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of 2026-08-10, and Fortinet describes the symbolic link persistency mechanism as something observed in real post-exploitation cases. Ransomware usage is currently marked as Unknown, and the EPSS score of 1.26% places it in the 67th percentile, consistent with targeted use rather than mass scanning.
What products are affected by CVE-2025-68686?
The vulnerability affects Fortinet FortiOS from 6.4.0 up to but not including 7.4.7, and from 7.6.0 up to but not including 7.6.2. In vendor terms this covers FortiOS 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, and all versions of the 7.2, 7.0, and 6.4 branches.
How do I fix CVE-2025-68686?
Upgrade FortiOS to 7.4.7 or 7.6.2 or later as described in Fortinet advisory FG-IR-25-934, and migrate the 6.4, 7.0, and 7.2 branches to a supported fixed release. Because exploitation requires an earlier filesystem-level compromise, also hunt for unexpected symbolic links, review the configuration for unauthorised accounts, and rotate all credentials stored on the device.
How severe is CVE-2025-68686?
CVE-2025-68686 is rated Medium with a CVSS 3.1 base score of 5.9: unauthenticated and remote, but with high attack complexity because the device must already be compromised, and with a high impact on confidentiality only. In a real intrusion chain the effective severity is higher than the score suggests, since the flaw restores an attacker's access to sensitive data on a perimeter security device after the original patch was applied.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.