CVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
What it is
Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
What to do
Schedule the vendor fix into this week’s change window, prioritising internet-facing and business-critical systems. Confirm the fix is applied everywhere, not just where it was easy.
- Priority
- This week: Schedule into this week’s change window.
- Severity (CVSS)
- 5.3 medium (vendor’s score; NVD analysis pending)
- CISA assessment (SSVC)
- actively exploited; needs manual effort per target; partial control or data exposure
- Exploit probability (EPSS, 30 days)
- 29%, higher than 98% of all CVEs
- Added to CISA KEV
- 27 July 2026
- CISA fix-by date
- 10 August 2026 (US federal agencies; a sensible deadline for everyone)
- Ransomware use
- Not known
References
Sources: CISA Known Exploited Vulnerabilities · FIRST Exploit Prediction Scoring System (EPSS) · NIST National Vulnerability Database · CISA Vulnrichment (SSVC), via the CVE Program. This product uses data from the NVD API but is not endorsed or certified by the NVD. Summaries are machine-written from CISA’s description; treat the vendor’s advisory as the authority for fixes.