CVE-2025-68686: Fortinet FortiOS information disclosure in SSL-VPN

CVE-2025-68686 · Severity: critical · CVSS 5.9 · Exploited in the wild · Published 2026-02-10

Fortinet FortiOS, the operating system powering FortiGate firewalls, contains a vulnerability that could allow an attacker to maintain access to a compromised system. This flaw specifically allows an attacker to bypass previous security patches intended to prevent malicious files from persisting on the device. To exploit this, an attacker must have already gained initial access to the device's file system through a separate security weakness.

Technologies: Fortinet FortiOS. Vendors: Fortinet.

Quick answers

Is CVE-2025-68686 exploited in the wild?
Yes. CVE-2025-68686 is known to be exploited in the wild, first recorded on 27 July 2026. Treat it as urgent.
How severe is CVE-2025-68686?
Critical severity, with a CVSS score of 5.9, published 10 February 2026.
Which products and versions are affected?
Fortinet FortiOS 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions.
Is there a fix for CVE-2025-68686?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-68686 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2025-68686?
Check whether you run Fortinet FortiOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Exposure of Sensitive Information vulnerability (CWE-200) exists in multiple versions of Fortinet FortiOS. The flaw allows a remote unauthenticated attacker to bypass security patches designed to mitigate symbolic link persistency mechanisms used in post-exploitation scenarios. Exploitation is achieved via crafted HTTP requests. A critical precondition is that the attacker must have already compromised the target device at the filesystem level via a separate vulnerability. This vulnerability has been observed in active exploitation as a means of maintaining persistence on compromised network appliances.

Affected products

  • Fortinet FortiOS 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions

Timeline

  • 2026-02-10: disclosed: Initial CVE entry created by Fortinet
  • 2026-07-27: advisory: NVD record updated with CISA enrichment data
  • 2026-07-27: kev added: CISA added to Known Exploited Vulnerabilities catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.