CVE-2025-68686

What it actually does

This is a high-confidentiality information disclosure issue in Fortinet FortiOS where crafted HTTP requests can bypass protections added for a previously observed symbolic-link persistence mechanism. The issue is not a standalone initial-access flaw: the attacker must already have compromised the device at the filesystem level through another vulnerability or access path. Once that prerequisite is met, the bypass can allow unauthenticated remote retrieval of sensitive data exposed through malicious or persistent symlinks, potentially including configuration material, secrets, credentials, certificates, VPN-related data, or other files reachable through the appliance filesystem. The supplied product metadata lists Craft CMS package fixes, but the vulnerability description, KEV status, and affected-version language describe Fortinet FortiOS; treat the product/version data as requiring vendor-advisory validation before remediation tracking.

Why it matters to the business

A successful attack can expose sensitive network security appliance data that may enable follow-on compromise of VPNs, administrative accounts, internal network access, or trusted integrations. Because the issue is listed in CISA KEV, marked as actively exploited in the wild, and has a remediation due date of 2026-08-10, organizations should treat exposed affected devices as urgent even though exploitation requires prior filesystem-level compromise. Operational consequences can include credential rotation, firewall/VPN rekeying, incident response on perimeter devices, and potential loss of trust in network boundary controls.

How an attack unfolds

An attacker first gains filesystem-level access to the affected FortiOS device by exploiting another vulnerability, stolen administrative access, or another compromise path. After obtaining that level of access, the attacker establishes or abuses a symbolic-link-based persistence or exposure mechanism on the appliance. The attacker then sends crafted HTTP requests to the FortiOS web interface or HTTP service to bypass the prior patch intended to prevent this symlink persistence technique. If successful, the requests cause sensitive files or configuration data to be disclosed to an unauthenticated remote actor. The exposed information can then be used for lateral movement, VPN/account compromise, credential theft, device re-entry, or preparation for additional attacks. Active exploitation has been observed in the wild, so detection should assume the vulnerability may be chained with earlier FortiOS compromise activity rather than appearing as an isolated web request anomaly.

How to fix it

Prioritize remediation of affected FortiOS branches referenced in the vulnerability description: FortiOS 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, all 7.2 versions, all 7.0 versions, and all 6.4 versions. Upgrade affected FortiOS devices to the vendor-recommended fixed release for the deployed branch and verify against the official Fortinet advisory because the supplied package metadata appears inconsistent with the FortiOS description. If the supplied package metadata is relevant to a separate dependency inventory, Craft CMS should be upgraded to 5.8.21 for the 5.x line or 4.16.17 for the 4.x line. Until FortiOS upgrades are complete, restrict administrative and HTTP/HTTPS management exposure to trusted networks only, disable unnecessary management interfaces on untrusted networks, enforce MFA for administrative access, review and remove unauthorized accounts/API tokens, rotate potentially exposed credentials and certificates, and inspect appliances for signs of prior compromise or unauthorized filesystem changes. Because exploitation requires prior filesystem-level compromise, patching should be paired with incident-response validation rather than treated as a simple version-only fix.

How to confirm the fix worked

Confirm exposure by inventorying FortiOS appliances and comparing running versions against the affected ranges and the official Fortinet advisory fixed releases. Validate that management interfaces are not reachable from untrusted networks unless explicitly required and protected. After upgrade, confirm the device reports the expected fixed FortiOS build, reboot status is clean, and configuration persists correctly. Perform filesystem-integrity checks or vendor-supported compromise assessments for unexpected symbolic links, modified web-accessible paths, unauthorized scripts, unknown administrative accounts, abnormal API tokens, and unexpected configuration exports. If Craft CMS package data is present in software-composition tooling, separately confirm composer.lock or package metadata shows craftcms/cms 5.8.21 or later on the 5.x branch, or 4.16.17 or later on the 4.x branch, but do not use those versions as evidence that a FortiOS appliance is remediated.

Typical attack path

1. Identify an internet-facing or otherwise reachable FortiOS device running an affected release.
2. Gain filesystem-level compromise of the device using a separate vulnerability, stolen credentials, malicious administrative access, or another post-exploitation technique.
3. Create, preserve, or abuse a symbolic link on the appliance that exposes sensitive filesystem content through a reachable path.
4. Send crafted unauthenticated HTTP requests that bypass the prior symlink-persistence patch logic.
5. Retrieve sensitive configuration, credential, certificate, or operational data from the device.
6. Use the disclosed data to maintain access, compromise VPN users or administrative accounts, move laterally, or target additional infrastructure.

How to detect it

Look for evidence of both prerequisite compromise and the information-disclosure stage. Relevant sources include FortiOS event logs, system logs, administrative audit logs, VPN logs, web-management access logs if available, configuration-revision history, backup/export history, centralized firewall logs, EDR/NDR telemetry around management access, and vendor-supported filesystem integrity or forensic outputs. Hunt for unusual unauthenticated HTTP requests to management interfaces, requests to unexpected or previously unseen paths, spikes in HTTP 200/206 responses with abnormal response sizes, access from unfamiliar external IPs, access outside normal administrative windows, and repeated probing of the web UI. Because the flaw depends on filesystem-level compromise, also inspect for unauthorized symbolic links, modified web-accessible directories, suspicious persistence artifacts, unexpected shell/script files, unknown administrator accounts, newly created API tokens, unexplained configuration exports, and administrative logins followed by filesystem or configuration changes. Correlate any suspicious disclosure activity with earlier exploitation attempts against FortiOS, successful admin logins, VPN anomalies, and outbound connections from the appliance. If sensitive data may have been exposed, assume credentials and certificates stored on the device are compromised until rotated.

What your security team should do

• Treat this as an urgent KEV remediation item and complete action by the 2026-08-10 due date or as soon as possible if that deadline has passed.
• Validate the product mapping against the official vendor advisory because the provided affected-product/fixed-version metadata conflicts with the FortiOS vulnerability description.
• Patch or upgrade all affected FortiOS appliances and prioritize internet-facing management interfaces first.
• Restrict FortiOS administrative HTTP/HTTPS access to dedicated management networks or trusted jump hosts; remove public exposure wherever possible.
• Hunt for evidence of prior FortiOS compromise, especially filesystem-level changes and unauthorized symbolic links, because exploitation requires an earlier compromise stage.
• Rotate credentials, API keys, VPN secrets, certificates, and administrative passwords that may have been stored on or retrievable from affected appliances.
• Review FortiOS administrative logins, configuration exports, new accounts, policy changes, and suspicious remote IP activity around the likely exposure window.
• Enable or forward FortiGate/FortiOS event, system, admin, VPN, and web-management logs to centralized logging for retrospective analysis.
• If compromise indicators are found, preserve forensic evidence and follow vendor incident-response guidance before rebuilding or replacing the appliance.