{"id":"CVE-2025-68686","kind":"vulnerability","aliases":["CVE-2025-68686"],"related":[],"title":"fortinet fortios: An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet…","description":"Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"FortiOS SSL-VPN symlink persistence patch bypass (CWE-200). The April 2025 patch checked for the substring /lang/custom, so requesting /lang//custom skips the check and serves the root filesystem read-only through a symlink an attacker already planted. It is only abusable on devices already compromised through another bug. Devices that never had SSL-VPN enabled are not affected. Fixed in 7.4.7 and 7.6.2; 7.2, 7.0 and 6.4 have no fix and need migrating. A public PoC and checker exist.","severity":"high","cvss":5.9,"epss":null,"exploited":true,"exploited_at":"2026-07-27T00:00:00+00:00","products":[{"name":"FortiOS","fixed":["7.4.7","7.6.2"],"affected":">= 7.6.0, <= 7.6.1; >= 7.4.0, <= 7.4.6; 7.2 all; 7.0 all; 6.4 all","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.4.7"],"affected":">= 6.4.0, < 7.4.7","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.6.2"],"affected":">= 7.6.0, < 7.6.2","ecosystem":"vendor"},{"name":"Fortinet FortiOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","fortinet","fortios","poc-public","self-hosted","ssl-vpn","vendor"],"not_affected_if":["fortios-7.4.7+","fortios-7.6.2+","non-fortinet-products","ssl-vpn-never-enabled"],"how_to_check":"Check the FortiOS version (get system status) against affected ranges, and whether SSL-VPN was ever enabled. Run the ITRESIT checker (github.com/I3IT/Fortigate.Symlink.Persistence.Checker) against the device to test patch status and for a leftover symlink. Look in web logs for requests containing /lang//custom or other access to the language directory. Treat any device that was exposed and unpatched during the 2023-2025 SSL-VPN exploitation as possibly compromised.","fix":"Upgrade FortiOS 7.4 to 7.4.7 or later and 7.6 to 7.6.2 or later. For 7.2, 7.0 and 6.4, migrate to a fixed release. Fortinet also offers a virtual patch, FG-VD-60389.0day, in the FMWP IPS db update 26.033. If a symlink is found, assume the config and secrets were read: rotate credentials, VPN PSKs and certificates.","status":"open","published_at":"2026-02-10T16:16:09+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:32:04+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-23T20:32:04Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations in Fortinet's vendor advisory as CISA directs; the specific fixed FortiOS version is unknown from these sources.\nUnknown whether a discontinue-use path is required if no mitigation exists.","summary":"A Fortinet FortiOS flaw lets a remote unauthenticated attacker send crafted HTTP requests that bypass an earlier patch for symbolic link persistence, which attackers use to keep access after exploitation. The description says an attacker must first compromise the device through another filesystem-level vulnerability.","category":"vendor","who_cares":["fortios","fortinet","self-hosted"],"confidence":0.6,"analyst_note":"Find the Fortinet PSIRT advisory for CVE-2025-68686 to get affected and fixed FortiOS versions, IOC/forensic check steps, and the mitigation list CISA refers to.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["non-fortinet-products"],"severity_if_unknown":"high"},"cost_usd":0.000408,"input_tokens":2288,"output_tokens":358,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2025-68686 to get affected and fixed FortiOS versions, IOC/forensic check steps, and the mitigation list CISA refers to.","search":"'-04':203C,229C,260C '-200':14A,53B '-2025':19A,22A '-68686':20A,23A '/custom':66B '/lang':65B '/lang/custom':62B '2025':56B '26':202C,228C,259C '6.4':115B '7.0':113B '7.2':112B '7.4.7':109B '7.6.2':111B 'abus':88B 'accord':192C 'action':188C 'actor':11A,139C 'adher':256C 'affect':106B 'allow':143C 'alreadi':83B,91B 'anoth':94B,181C 'appli':189C 'applic':226C 'april':55B 'asset':250C 'attack':82B,147C,171C 'base':207C 'bod':201C,227C,258C 'bug':95B 'bypass':51B,149C 'case':165C 'check':58B,69B 'checker':126B 'cisa':186C,199C,216C 'cloud':232C 'complianc':197C 'compromis':92B,177C 'contain':130C 'craft':167C 'cve':18A,21A 'cwe':13A,52B 'develop':152C 'devic':90B,96B 'discontinu':235C 'enabl':103B 'ensur':196C,255C 'evalu':248C 'exist':127B 'exploit':31B,164C 'exposur':4A,132C,253C 'filesystem':74B,184C 'first':174C 'fix':107B,118B 'follow':225C 'forens':218C 'fortinet':1A,17A,25A,27A,29A,32B,128C 'fortio':2A,33B,44B,129C 'fortios':24A,26A,28A,30A 'guidanc':214C,230C 'guidelin':262C 'host':39B 'http':168C 'inform':7A,135C 'instruct':195C 'internet':252C 'level':185C 'link':156C 'may':142C 'mechan':158C 'migrat':121B 'mitig':190C,241C 'need':120B,173C 'never':98B 'note':213C,224C 'observ':159C 'patch':50B,57B,151C,261C 'persist':49B,157C 'plant':84B 'poc':35B,124B 'poc-publ':34B 'post':163C 'post-exploit':162C 'priorit':204C 'product':179C,239C 'public':36B,123B 'read':76B 'read-on':75B 'remot':145C 'request':64B,169C 'requir':187C,220C 'respons':246C 'risk':209C 'root':73B 'secur':205C 'see':210C,221C 'self':38B 'self-host':37B 'sensit':6A,134C 'serv':71B 'servic':233C 'skip':67B 'ssl':41B,46B,101B 'ssl-vpn':40B,45B,100B 'stakehold':244C 'substr':61B 'symbol':155C 'symlink':48B,80B 'triag':219C 'unauthent':146C 'unauthor':10A,138C 'unavail':243C 'updat':206C 'url':211C,222C 'use':236C 'vendor':43B,194C 'via':166C,180C 'vpn':42B,47B,102B 'vulner':12A,15A,140C,182C 'would':172C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-02-10T16:16:09+00:00","kev":{"dateAdded":"2026-07-27","dueDate":"2026-08-10","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@fortinet.com","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2025-68686","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68686","severity":null,"published_at":"2026-07-27T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-68686:135","url":null,"severity":null,"published_at":"2026-10-23T21:42:29+00:00","modified_at":"2026-10-23T21:42:29+00:00","first_seen_at":"2026-10-23T21:42:29+00:00","fetched_at":"2026-10-23T21:42:29+00:00","note":"Read FortiGuard FG-IR-25-934 (published 2026-02-10) and ITRESIT PoC write-up; KEV listing taken from the triage source, not re-checked. Social chatter not searched."},{"source":"nvd","external_id":"CVE-2025-68686","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68686","severity":null,"published_at":"2026-02-10T16:16:09+00:00","modified_at":"2026-07-28T05:17:04+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[{"id":1213,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-934","title":"FG-IR-25-934 SSL-VPN Symlink Persistence Patch Bypass","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1216,"url":"https://labs.itresit.es/2026/02/11/fortigate-symlink-persistence-method-patch-bypass-cve-2025-68686/","title":"ITRESIT: double slash bypass of FortiGate symlink patch","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1217,"url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","title":"Fortinet: Analysis of Threat Actor Activity (symlink persistence)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}