{"id":"fortios-symlink-persistence-bypass-feb-2026","category":"patch","status":"closed","title":"Fortinet FortiOS CVE-2025-68686 exploited to bypass an earlier fix on compromised firewalls","tldr":"Attackers are using a FortiOS flaw to read private information from previously compromised FortiGate firewalls. Fixes are in 7.4.7 and 7.6.2; older branches require migration. Ask your IT provider to update and investigate earlier intrusion.","summary":"CVE-2025-68686 affects Fortinet FortiOS, the software running FortiGate firewalls. It bypasses an earlier defence against a mechanism attackers used to retain access to sensitive files after an intrusion. Although subsequent access requires no login, Fortinet says an attacker must first have compromised the device's filesystem through another vulnerability. CISA confirmed exploitation by adding it to its catalogue on 27 July 2026. Fortinet's release notes confirm fixes in 7.4.7 and 7.6.2. FortiOS 6.4, 7.0 and 7.2 have no fix within those branches and require migration, so patch coverage remains partial. CERT Vanuatu advises checking for earlier compromise as well as updating. The reviewed sources do not identify victims or establish when attacks began. Both Fortinet and NVD rate the flaw medium, although Fortinet's CVE record lists a score of 5.3 and NVD displays 5.9 attributed to Fortinet.","action":"If your office or managed home network uses a FortiGate firewall, ask its IT provider to install FortiOS 7.4.7 or later in the 7.4 branch, or 7.6.2 or later in the 7.6 branch. Devices running 6.4, 7.0 or 7.2 need migration to a fixed release; also ask for an investigation of earlier compromise.","product":"Fortinet FortiGate firewalls running FortiOS","audience":"work","severity":"medium","patch":"partial","exploited":true,"cves":["CVE-2025-68686"],"tags":["fortinet","fortios","fortigate","firewall","vpn","information-disclosure","exploited"],"affected":["FortiOS 7.6.0 through 7.6.1","FortiOS 7.4.0 through 7.4.6","FortiOS 7.2 — all versions","FortiOS 7.0 — all versions","FortiOS 6.4 — all versions"],"fixed":["FortiOS 7.4.7 and later in the 7.4 branch","FortiOS 7.6.2 and later in the 7.6 branch"],"matches":[],"sources":[{"kind":"advisory","title":"Fortinet's published CVE-2025-68686 record","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json","by":"Fortinet","date":"2026-02-10"},{"kind":"advisory","title":"FortiOS 7.4.7 release notes: resolved issues","url":"https://docs.fortinet.com/document/fortigate/7.4.7/fortios-release-notes/289806/resolved-issues","by":"Fortinet","date":""},{"kind":"advisory","title":"FortiOS 7.6.2 release notes: resolved issues","url":"https://docs.fortinet.com/document/fortigate/7.6.2/fortios-release-notes/289806/resolved-issues","by":"Fortinet","date":""},{"kind":"advisory","title":"CVE-2025-68686 detail and CISA exploitation listing","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68686","by":"NIST NVD","date":"2026-07-28"},{"kind":"advisory","title":"Advisory 174: Fortinet FortiOS SSL-VPN Symlink Persistence Patch Bypass","url":"https://cert.gov.vu/index.php/advisories/185-advisory-174","by":"CERT Vanuatu","date":"2026-07-27"},{"kind":"advisory","title":"Fortinet Products Multiple Vulnerabilities","url":"https://www.hkcert.org/security-bulletin/fortinet-products-multiple-vulnerabilities_20260211","by":"HKCERT","date":"2026-07-28"},{"kind":"advisory","title":"Fortinet product security update recommendation","url":"https://krcert.or.kr/kr/bbs/view.do?bbsId=B0000133&categoryCode=&menuNo=205020&nttId=72143&pageIndex=1&searchCnd=&searchWrd=","by":"KISA","date":"2026-07-29"}],"started":"2026-07-27","closed":"2026-07-29","created":"2026-11-03T22:19:29.631Z","updated":"2026-11-03T22:19:29.631Z","cve_notes":[{"cve":"CVE-2025-68686","name":"FortiOS SSL-VPN persistent-access patch bypass","what":"A flaw in FortiOS lets an attacker read sensitive information without logging in by bypassing an earlier defence against persistent file access, provided the device's filesystem was already compromised through another vulnerability.","severity":"medium","cvss":5.3}],"timeline":[{"at":"2026-07-29","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"KISA advised upgrading affected 7.4 and 7.6 installations to 7.4.7 or 7.6.2 and later, respectively. Its guidance requires migration from FortiOS 6.4, 7.0 and 7.2 to a fixed release.","url":"https://krcert.or.kr/kr/bbs/view.do?bbsId=B0000133&categoryCode=&menuNo=205020&nttId=72143&pageIndex=1&searchCnd=&searchWrd=","by":"KISA","patch":null},{"at":"2026-07-28","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"HKCERT updated its bulletin to warn that attackers were exploiting the flaw. It reiterated that exploitation requires an earlier compromise of the device's filesystem through another vulnerability.","url":"https://www.hkcert.org/security-bulletin/fortinet-products-multiple-vulnerabilities_20260211","by":"HKCERT","patch":null},{"at":"2026-07-27","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2025-68686 to its Known Exploited Vulnerabilities catalogue, confirming exploitation. The remediation deadline for covered US federal agencies was 10 August.","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68686","by":"NIST NVD","patch":null},{"at":"2026-02-10","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Fortinet published CVE-2025-68686, a bypass of an earlier defence against persistent access to compromised FortiOS devices. Its CVE record identifies 7.4.7 and 7.6.2 as fixed releases.","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json","by":"Fortinet","patch":"partial"}],"url":"https://hard.fyi/live/fortios-symlink-persistence-bypass-feb-2026/","json":"https://hard.fyi/api/live?id=fortios-symlink-persistence-bypass-feb-2026"}