CVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Fortinet · FortiOS · NVD published 2026-02-10 · posted 2026-07-27 · last modified 2026-07-28
What it is
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
| Weakness | CWE-200 |
|---|---|
| CVSS vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (source: [email protected]) |
| CISA due date | 2026-08-10 (for US federal agencies under BOD; a good deadline for everyone) |
| ATT&CK tactics | Collection |
Exploitation evidence
First exploit evidence seen: 2026-07-27 (earliest date across the sources below).
Exploited in the wild
- CISA KEV: listed since 2026-07-27. Source
Sources: CISA KEV.
Defend the Chain
The attack chain for CVE-2025-68686 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.
Pick a red technique card on the board, then choose the defence that stops it.
Defend against T1005 Data from Local System Inferred
Inferred from CWE CWE-200
How to fix it
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (source: CISA KEV)
Fixed versions
- fortinet fortios: upgrade to 7.4.7 or later (affected from 6.4.0)
- fortinet fortios: upgrade to 7.6.2 or later (affected from 7.6.0)
Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.
Vendor advisories and patches
- https://fortiguard.fortinet.com/psirt/FG-IR-25-934 (CISA KEV notes)
MITRE ATT&CK mitigations for this chain
- M1057 Data Loss Prevention (for T1005) : Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.
Detection Generic guidance
- Collection: Watch for bulk reads of databases, file shares or mailboxes by the affected service.
Response checklist Generic guidance
- Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
- Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
- Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
- Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.