Security readout for executives and security teams
Plain-English summary
This flaw can undermine Fortinet’s protection against a persistence technique after a FortiOS device has already been compromised at filesystem level. Crafted remote requests may then expose sensitive information. It is not an initial-entry vulnerability, but CISA’s KEV listing makes previously compromised or internet-reachable appliances urgent investigation targets.
Executive priority
Prioritize immediate assessment because exploitation is recognized by CISA and affected appliances often protect sensitive network boundaries. Patch according to Fortinet guidance, but escalate suspected prior compromise to full incident response. Remediation alone may not establish that a previously compromised device is trustworthy.
Technical view
CVE-2025-68686 is a CWE-200 information-exposure flaw affecting FortiOS 7.6.0–7.6.1, 7.4.0–7.4.6, and all 7.2, 7.0, and 6.4 releases. A remote unauthenticated attacker can use crafted HTTP requests to bypass a patch for a symbolic-link persistence mechanism, but must first obtain filesystem-level compromise through another vulnerability. CVSS 3.1 is 5.3.
Likely exposure
Exposure exists where an affected FortiOS release is deployed, especially if its HTTP interface is remotely reachable or the appliance may have suffered an earlier compromise. Version presence alone does not establish exploitability because filesystem-level compromise is a prerequisite. Devices with credible prior intrusion indicators carry the greatest risk.
Exploitation context
CISA lists CVE-2025-68686 in the Known Exploited Vulnerabilities catalog, supporting active exploitation in the wild. The supplied evidence does not describe campaign scale, targeted sectors, or the initial vulnerabilities used to gain filesystem access. The CVSS vector indicates high complexity and confidentiality impact without stated integrity or availability impact.
Researcher notes
The vulnerability is post-compromise: unauthenticated network access applies to the crafted HTTP request, while successful use still requires prior filesystem control. Avoid treating CVSS 5.3 as the complete operational risk because KEV status raises urgency. The supplied bundle does not identify fixed versions, observable request patterns, or forensic indicators; obtain those from current Fortinet guidance.
Mitigation direction
- Consult FG-IR-25-934 and upgrade each affected appliance to a Fortinet-designated fixed release.
- Restrict remote access to FortiOS HTTP management interfaces where operationally possible.
- Treat affected devices with suspected prior compromise as incident-response cases, not routine patching only.
- Preserve relevant evidence before rebuilding or replacing any potentially compromised appliance.
Validation and detection
- Inventory FortiOS versions and identify releases within the documented affected ranges.
- Confirm whether HTTP management interfaces are reachable from untrusted networks.
- Review affected appliances for evidence of earlier filesystem compromise or unauthorized persistence.
- Verify installed remediation against Fortinet advisory FG-IR-25-934.
- After remediation, confirm configuration integrity and investigate unexplained sensitive-information access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-68686 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C2.23.6fortinetVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2025-68686 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-07-27T00:00:00.000Z: CVE-2025-68686 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://fortiguard.fortinet.com/psirt/FG-IR-25-934CVE reference, fortinet
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.