NewsCompaniesFlawsGuides
Get the app
MediumPartly fixedBeing used in attacksClosedUpdated

Fortinet FortiOS CVE-2025-68686 exploited to bypass an earlier fix on compromised firewalls

Attackers are using a FortiOS flaw to read private information from previously compromised FortiGate firewalls. Fixes are in 7.4.7 and 7.6.2; older branches require migration. Ask your IT provider to update and investigate earlier intrusion.

What to do

If your office or managed home network uses a FortiGate firewall, ask its IT provider to install FortiOS 7.4.7 or later in the 7.4 branch, or 7.6.2 or later in the 7.6 branch. Devices running 6.4, 7.0 or 7.2 need migration to a fixed release; also ask for an investigation of earlier compromise.

What’s happening

CVE-2025-68686 affects Fortinet FortiOS, the software running FortiGate firewalls. It bypasses an earlier defence against a mechanism attackers used to retain access to sensitive files after an intrusion. Although subsequent access requires no login, Fortinet says an attacker must first have compromised the device's filesystem through another vulnerability. CISA confirmed exploitation by adding it to its catalogue on 27 July 2026. Fortinet's release notes confirm fixes in 7.4.7 and 7.6.2. FortiOS 6.4, 7.0 and 7.2 have no fix within those branches and require migration, so patch coverage remains partial. CERT Vanuatu advises checking for earlier compromise as well as updating. The reviewed sources do not identify victims or establish when attacks began. Both Fortinet and NVD rate the flaw medium, although Fortinet's CVE record lists a score of 5.3 and NVD displays 5.9 attributed to Fortinet.

What
Flaw
Affects
Fortinet FortiGate firewalls running FortiOS
Affected
FortiOS 7.6.0 through 7.6.1
FortiOS 7.4.0 through 7.4.6
FortiOS 7.2 — all versions
FortiOS 7.0 — all versions
FortiOS 6.4 — all versions
Fixed in
FortiOS 7.4.7 and later in the 7.4 branch
FortiOS 7.6.2 and later in the 7.6 branch
CVE
CVE-2025-68686
Since
27 July 2026
Closed
29 July 2026

Timeline

  1. Update

    KISA advised upgrading affected 7.4 and 7.6 installations to 7.4.7 or 7.6.2 and later, respectively. Its guidance requires migration from FortiOS 6.4, 7.0 and 7.2 to a fixed release.

  2. Update

    HKCERT updated its bulletin to warn that attackers were exploiting the flaw. It reiterated that exploitation requires an earlier compromise of the device's filesystem through another vulnerability.

  3. CISA added

    CISA added CVE-2025-68686 to its Known Exploited Vulnerabilities catalogue, confirming exploitation. The remediation deadline for covered US federal agencies was 10 August.

  4. Made publicPartly fixed

    Fortinet published CVE-2025-68686, a bypass of an earlier defence against persistent access to compromised FortiOS devices. Its CVE record identifies 7.4.7 and 7.6.2 as fixed releases.

Sources

  1. Fortinet's published CVE-2025-68686 recordFortinet · 10 Feb 2026
  2. FortiOS 7.4.7 release notes: resolved issuesFortinet
  3. FortiOS 7.6.2 release notes: resolved issuesFortinet
  4. CVE-2025-68686 detail and CISA exploitation listingNIST NVD · 28 July 2026
  5. Advisory 174: Fortinet FortiOS SSL-VPN Symlink Persistence Patch BypassCERT Vanuatu · 27 July 2026
  6. Fortinet Products Multiple VulnerabilitiesHKCERT · 28 July 2026
  7. Fortinet product security update recommendationKISA · 29 July 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from July 2026 · JSON · RSS