Advisory · CVE-2025-68686
FortiOS patch bypass keeps old firewall footholds alive
Attackers who previously compromised a FortiGate at the filesystem level can bypass the patch for Fortinet's symlink persistence mitigation and read sensitive files via crafted HTTPS requests.
- Vendor
- Fortinet
- Product
- FortiOS
- Identifier / CWE
- CVE-2025-68686
CWE-200 - Action timing
- Aug 17, 2026
Explain it like I’m five
A burglar hid a spare key inside your house before you changed the locks. This flaw lets them reach through the mail slot and grab that spare key again, even though you thought the locks were fixed.
- 01Earlier compromise
The attacker previously gained filesystem-level access to the FortiGate through a different vulnerability and planted symlink artifacts.
- 02Original patch applied
Fortinet's earlier fix blocked the known symlink persistence technique, but the attacker's artifacts remained on disk.
- 03Bypass request
The attacker sends crafted HTTPS requests to the SSL-VPN web interface, bypassing the patch's mitigation.
- 04Sensitive files read
The attacker reads configurations, VPN credentials, and keys, which can be reused as legitimate-looking VPN authentication.
What happened
FortiOS contains an exposure of sensitive information (CWE-200, CVSS 5.9) that lets a remote unauthenticated attacker bypass the patch Fortinet developed for the symbolic-link persistence mechanism seen in earlier post-exploitation activity, using crafted HTTP requests against the SSL-VPN interface. Crucially, this vulnerability does not grant initial access on its own: the attacker must first have compromised the device at the filesystem level through a different vulnerability. Affected versions are FortiOS 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, and all versions of 7.2, 7.0, and 6.4. Fortinet’s advisory FG-IR-25-934 names 7.6.2 and 7.4.7 (or later) as the fixed releases; the 7.2, 7.0, and 6.4 branches require migration to a fixed branch. CISA added the issue to its Known Exploited Vulnerabilities catalog on July 27, 2026, confirming active exploitation.
What to do
- Upgrade to FortiOS 7.6.2 or 7.4.7 or later; migrate devices on the 7.2, 7.0, and 6.4 branches to a supported fixed release.
- Do not assume patching alone evicts an attacker: if the device ran a vulnerable release during 2022-2024 and was internet-exposed, treat it as potentially compromised and investigate before or alongside patching.
- Inspect for persistence artifacts, including unauthorized symlinks on the filesystem and unexpected SSL-VPN access patterns in logs.
- Where compromise is suspected, rebuild the device from a known-good image and rotate all credentials and keys that passed through it, including VPN credentials, admin accounts, and certificates.
- Restrict reachability of the SSL-VPN and management interfaces to trusted sources, and disable them where they are not needed.
Management note
This one breaks the comforting assumption that patching equals safety. The flaw specifically rewards attackers who got in earlier and waited, so the real question is not just whether you are patched but whether anyone was already inside when you patched. Pair the upgrade with a compromise assessment, or you may secure the door while the intruder is still in the building.