CVE-2025-68686

Summary

Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

Published 2026-07-27 · first seen here 2026-10-10

CISA required action (due 2026-08-10): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Analysis & write-ups

No technical write-up from a research team yet. Contact Zero checks Unit 42, Google/Mandiant, Microsoft, Talos, CrowdStrike, Rapid7, watchTowr and others several times a day, plus NVD and CISA reference links.

Where it shows in your logs

Edge or network appliance (firewall, VPN, gateway) · Information disclosure or memory leak high confidence

Appliances usually run no EDR, so device logs, firewall flow logs and the vendor's integrity checker are often the only evidence. Get the logs off the box: attackers often wipe local logs.

What to look for

• One session or token used from several IPs or user agents (session hijacking)
• Logins with harvested credentials shortly after unusual requests to the vulnerable endpoint
• Unusually large responses to unauthenticated requests
• Configuration changes, new local admin accounts or new VPN users on the appliance
• Admin or VPN logins from unfamiliar IPs, especially VPS or hosting providers
• New outbound connections from the appliance's own IP (it should rarely start connections)
• Gaps in the appliance's logs, unexpected reboots or crashes, or logs that were cleared

Data sources

A generic baseline worked out from the product type and weakness (CWE-200), not a detection. Check table and field names against your environment. Hunt queries for Sigma, Splunk, Sentinel and CrowdStrike are coming.

References

• NVD entry
• CISA KEV
• https://fortiguard.fortinet.com/psirt/FG-IR-25-934
• https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
• https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk