CVE-2025-68686: Fortinet FortiOS SSL-VPN Symlink Persistence Patch Bypass Exploited in the Wild

CVE-2025-68686 lets unauthenticated remote attackers bypass the Fortinet FortiOS SSL-VPN symlink persistence patch. Sensitive information exposure is High. CISA added it to KEV; remediation deadline is 10 August 2026.

Incident Overview

CVE-2025-68686 is a bypass of an earlier patch for the symlink persistence mechanism in Fortinet FortiOS SSL-VPN, assigned FG-IR-25-934 by FortiGuard Labs. An unauthenticated remote attacker can craft HTTP requests to bypass the prior symlink-persistence fix and read sensitive data from the FortiGate filesystem. Confirmed exploited in the wild. CISA added it to the KEV catalog on 27 July 2026 and set a 10 August 2026 mandatory patch deadline for FCEB agencies.

Technical Details

Affected Products

• FortiOS 7.6.0 ~ 7.6.1: upgrade to 7.6.2 or later
• FortiOS 7.4.0 ~ 7.4.6: upgrade to 7.4.7 or later
• FortiOS 7.2 all releases: migrate to a fixed version (recommend 7.4.x supported branch)
• FortiOS 7.0 all releases, FortiOS 6.4 all releases: affected and EOL; migrate to a supported branch

Vulnerability Mechanics

Fortinet previously shipped a fix for SSL-VPN symlink persistence (blocking some known post-exploitation access). CVE-2025-68686 bypasses that fix: the attacker does not need prior root on the device filesystem, but must first obtain filesystem-level read-only access via another known vuln, then use this bypass on residual patched paths to read sensitive files. Mapped to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Medium severity. CVSS 3.1 base 5.3. Score is modest, but in-the-wild use and position in the attack chain led CISA to add it to KEV immediately rather than wait for a normal rating cycle.

External Intel and Attribution

Initially reported under coordinated disclosure by external researcher Peter Gabaldon (ITRESIT). Fortinet's PSIRT advisory also cites blog analysis: attackers typically chain other disclosed FortiGate vulns (e.g. FG-IR-24-015) for an end-to-end path, then read configs, certs, and credentials after the patch bypass.

Impact Assessment

FortiGate is a common enterprise-edge NGFW. SSL-VPN interfaces are often exposed to remote workers. Successful filesystem reads can yield:

• Device config files (firewall rules, IPsec PSKs, VPN user password hashes)
• Admin certs and private keys
• FortiManager comms certs and credentials, enabling compromise of the central management plane

This is a patch bypass. Devices already patched for symlink persistence remain exposed. Redeploy a new version.

Remediation

Immediate Actions

• Federal: FCEB deadline 10 August 2026
• Non-federal: treat as emergency under in-the-wild exploitation
• 7.6 branch: upgrade to 7.6.2+
• 7.4 branch: upgrade to 7.4.7+
• EOL 7.0/7.2/6.4 branches: migrate to 7.4 or 7.6 supported branch

Mitigation and Hardening

• Before upgrade, deploy Fortinet virtual patch signature FG-VD-60389.0day (shipped in IPS package db update 26.033; blocks known exploit signatures)
• Disable unused SSL-VPN interfaces; restrict VPN ingress to required IP ranges
• Audit SSL-VPN anomalous session logs in FortiAnalyzer; watch abnormal POST patterns
• Assume prior symlink persistence: rotate admin passwords, IPsec PSKs, local certs, and FortiManager/FortiCloud comms keys
• Full config audit and baseline diff on all FortiGate devices

References

• FortiGuard PSIRT FG-IR-25-934
• CISA 27 July KEV addition notice
• NVD: CVE-2025-68686 details
• Fortinet upgrade tool