ADVISORY SUMMARY
CISA added CVE-2025-68686 to its KEV catalog on July 27, 2026, after confirming active exploitation. The flaw (CWE-200) in Fortinet FortiOS allows a remote unauthenticated attacker to bypass the patch designed to prevent a symbolic link persistence technique used by threat actors to maintain post-exploitation access on compromised FortiGate devices. Exploitation requires the attacker to have first obtained filesystem-level access via a separate vulnerability. Federal FCEB agencies must apply mitigations by August 10, 2026 per BOD 26-04.
AFFECTED SYSTEMS
MITIGATION GUIDANCE
Apply the patches identified in Fortinet PSIRT advisory FG-IR-25-934 immediately. Identify all internet-facing FortiOS/FortiGate assets and determine if management interfaces or SSL-VPN services are externally exposed. Follow Fortinet vendor guidance and BOD 26-04 requirements. If prior compromise is suspected, conduct full forensic review before patching as the symbolic link persistence technique may have already been deployed.
DETECTION SIGNATURES
Investigate FortiOS filesystem for suspicious symbolic links in the SSL-VPN web root and related directories, which is the known post-exploit persistence technique this CVE's patch bypasses. Review HTTP request logs on the management interface for crafted requests. Audit VPN and admin login activity for anomalous access patterns. Check for unexpected files in SSL-VPN certificate and config directories.
REFERENCES
- → https://fortiguard.fortinet.com/psirt/FG-IR-25-934
- → https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
- → https://nvd.nist.gov/vuln/detail/CVE-2025-68686
- → https://cybersecuritynews.com/fortinet-fortios-vulnerability-exploited/