CVE-2025-68686

What is FortiOS SSL-VPN?

FortiOS is the operating system running on FortiGate firewalls — Fortinet's core network security appliance and, by volume, one of the most widely deployed perimeter gateways in enterprise, MSP, and government networks. The affected component is SSL-VPN, the remote-access portal that FortiGate exposes directly to the internet. Devices with SSL-VPN disabled are not affected.

Understanding this CVE requires the April 2025 symlink persistence incident as background. Fortinet disclosed that threat actors who had previously compromised FortiGate devices — via older flaws including CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762 — were planting a symbolic link joining the user filesystem to the root filesystem inside the directory used to serve SSL-VPN language files. Because that directory is served by the SSL-VPN web daemon and lives on the writable user filesystem, the symlink survived firmware upgrades and patching. The result was continued read-only access to the appliance's root filesystem — configuration, credentials, certificates — on devices whose owners believed they had been fully remediated.

The scale was substantial. Shadowserver counted 16,620 internet-exposed Fortinet devices carrying the symlink backdoor as of 2025-04-15: 7,886 in Asia, 3,766 in Europe, 3,217 in North America, 1,054 in South America, 399 in Africa, and 298 in Oceania.

Fortinet shipped a patch to detect and strip that symlink and to stop the SSL-VPN daemon from serving it. CVE-2025-68686 is a bypass of that patch.

Overview

FortiOS contains an information exposure vulnerability that allows a remote, unauthenticated attacker to bypass the remediation Fortinet developed for the SSL-VPN symlink persistency mechanism, using crafted HTTP requests. In effect, it restores the attacker's root filesystem read access on appliances that were supposed to have been cleaned.

The critical qualifier is in Fortinet's own description: an attacker would need first to have compromised the product via another vulnerability, at filesystem level. This is a post-exploitation persistence-retention bug, not an initial access bug. It has no value against a device that was never compromised — and correspondingly, a device where this flaw can be successfully exploited should be treated as already breached.

CISA added the CVE to the KEV catalog on 2026-07-27, roughly five and a half months after Fortinet's advisory, confirming exploitation in the wild.

Affected Versions

Devices without SSL-VPN enabled are not impacted. Note that the 7.2, 7.0, and 6.4 branches receive no in-branch fix — Fortinet directs affected users to migrate to 7.4.7+ or 7.6.2+.

Technical Details

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor. Fortinet's remediation for the April 2025 incident added logic to detect and neutralize the planted symlink and to prevent the SSL-VPN daemon from following it when serving language files. This vulnerability is a defect in that logic: crafted HTTP requests evade the sanitization and cause the daemon to serve content through the symlink again.

Attack characteristics:

• Authentication: none for the HTTP request itself — the SSL-VPN portal serves language files pre-authentication, which is precisely why the language-file directory was chosen as the persistence location in the first place.
• Complexity: High (AC:H). The high rating reflects two things: the precondition of prior filesystem-level compromise, and the request-crafting specificity needed to defeat the sanitizer.
• Impact: confidentiality only (C:H/I:N/A:N). The primitive is arbitrary read of the root filesystem — configuration backups, hashed credentials, certificates, and VPN user data. No write or denial-of-service capability follows from this flaw alone.
• Scope: Unchanged (S:U), consistent with a read-only disclosure confined to the same appliance.
• Inherently chained. Because the flaw is only reachable after initial compromise, it is by construction the later stage of a chain: initial RCE (for example CVE-2024-21762 or another FortiOS pre-auth flaw) → filesystem write → symlink plant → CVE-2025-68686 to keep that symlink readable after Fortinet's remediation patch is applied.

Fortinet did not publish the specific traversal or encoding technique used to defeat the sanitizer, and no public technical analysis has appeared.

A note on scoring. The NVD and Fortinet base score is 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). The FortiGuard advisory page displays 5.3 because it applies temporal metrics — E:P/RL:O/RC:C for Proof-of-Concept exploit maturity, Official Fix available, and Confirmed report confidence. The 5.9 base score is the correct figure for comparison against other CVEs.

Discovery

Reported to Fortinet through its responsible disclosure process by Peter Gabaldon of ITRESIT, credited in the acknowledgement section of advisory FG-IR-25-934. The date of the report to Fortinet has not been published; the advisory appeared on 2026-02-10.

Exploitation Context

Confirmed exploited — CISA added CVE-2025-68686 to the KEV catalog on 2026-07-27. Worth noting for anyone cross-checking sources: the FortiGuard advisory page still reads "Known Exploited: No" and does not appear to have been updated to reflect the KEV listing. The CISA entry is authoritative here.

No threat actor has been named for this specific CVE. The parent symlink campaign was attributed only generically to actors leveraging older FortiGate remote code execution flaws (CVE-2022-42475, CVE-2023-27997, CVE-2024-21762). Likewise, no exposure counts specific to this bypass have been published — the 16,620 Shadowserver figure cited above measures the original April 2025 symlink backdoor population, not devices vulnerable to this patch bypass, and should be read as scale context rather than a count of exploitable systems.

The defensive implication deserves emphasis. Prior compromise is a precondition for exploitation. Any device on which this vulnerability can be successfully exploited has already been breached through some other flaw, and its configuration and credentials should be presumed disclosed. Patching alone is not a sufficient response.

The 14-day remediation deadline — longer than the three days assigned to the concurrently-listed CVE-2026-16812 — reflects BOD 26-04's risk tiering. Read-only impact and high attack complexity requiring prior compromise place it below the "total control, automatable" tier.

Remediation

1. Upgrade FortiOS to 7.6.2 or above, or 7.4.7 or above. For the 7.2, 7.0, and 6.4 branches there is no in-branch fix — migrate to a supported fixed branch.
2. Apply virtual patching as an interim control. Fortinet published FortiGuard IPS signature FG-VD-60389.0day., available in FMWP database update 26.033. This helps appliances that cannot be upgraded immediately, but it is a mitigation, not a fix.
3. Disable SSL-VPN if it is not required. This removes the affected component entirely and is the most complete mitigation available short of patching.
4. Assume prior compromise and hunt for it. Because exploitability implies an earlier breach, follow Fortinet's April 2025 symlink guidance: inspect the SSL-VPN language-file directory for unexpected symbolic links joining the user filesystem to root, and review SSL-VPN web request logs for anomalous language-file requests, unusual encoding, or traversal-shaped paths.
5. If a symlink or evidence of access is found, treat the entire device configuration as disclosed. Rotate all device credentials, local and remote VPN user passwords, pre-shared keys, and API keys, and re-issue certificates. Then review the configuration for attacker-added administrator accounts, modified trusted hosts, unexpected static routes, and policy changes.
6. Reduce SSL-VPN portal exposure where operationally feasible — geo-fencing, source IP allowlisting, and enforced MFA on all VPN accounts. The original campaign depended on internet-reachable SSL-VPN portals; limiting who can reach the portal limits both the initial-access flaws and this persistence mechanism.