CISA Adds Actively Exploited Fortinet FortiOS Vulnerability to KEV Catalog
CISA has included CVE-2025-68686, an actively exploited vulnerability in Fortinet FortiOS, in its Known Exploited Vulnerabilities (KEV) catalog following confirmed attacks. The flaw affects FortiGate firewalls and other Fortinet security products running FortiOS, classified as an information exposure issue (CWE-200).
The vulnerability allows a remote, unauthenticated attacker to bypass a patch designed to block symbolic link (symlink) persistence techniques by sending crafted HTTP requests. However, exploitation requires prior filesystem-level access, meaning attackers must first compromise the device through another vulnerability.
Once exploited, CVE-2025-68686 enables threat actors to evade security protections, maintain persistence, access restricted files, or disrupt remediation efforts. While CISA has not linked the flaw to ransomware campaigns, its active exploitation status elevates it to a high-priority security risk, particularly for internet-exposed FortiOS appliances.
Federal agencies under the Civilian Executive Branch must apply mitigations by August 10, 2026, per Binding Operational Directive 26-04. Organizations are advised to:
- Identify all FortiOS deployments and assess internet-facing interfaces.
- Review Fortinet advisories for patches or mitigations.
- Investigate devices for signs of prior compromise, including unauthorized logins, configuration changes, or persistence artifacts.
- Isolate or decommission affected systems if no patch is available.
The addition to the KEV catalog highlights the ongoing targeting of perimeter security appliances by threat actors seeking persistent network access.
Source: https://cybersecuritynews.com/fortinet-fortios-vulnerability-exploited/
Fortinet TPRM report: https://www.rankiteo.com/company/fortinet
"id": "for1785219834",
"linkid": "fortinet",
"type": "Vulnerability",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Organizations using FortiGate '
'firewalls and FortiOS',
'industry': 'Cybersecurity',
'name': 'Fortinet',
'type': 'Technology Vendor'}],
'attack_vector': 'Remote, unauthenticated HTTP requests',
'data_breach': {'type_of_data_compromised': 'Restricted files'},
'description': 'CISA has included CVE-2025-68686, an actively exploited '
'vulnerability in Fortinet FortiOS, in its Known Exploited '
'Vulnerabilities (KEV) catalog following confirmed attacks. '
'The flaw affects FortiGate firewalls and other Fortinet '
'security products running FortiOS, classified as an '
'information exposure issue (CWE-200). The vulnerability '
'allows a remote, unauthenticated attacker to bypass a patch '
'designed to block symbolic link (symlink) persistence '
'techniques by sending crafted HTTP requests. Exploitation '
'requires prior filesystem-level access, enabling threat '
'actors to evade security protections, maintain persistence, '
'access restricted files, or disrupt remediation efforts.',
'impact': {'data_compromised': 'Restricted files access',
'operational_impact': 'Disruption of remediation efforts, evasion '
'of security protections',
'systems_affected': 'FortiGate firewalls, Fortinet security '
'products running FortiOS'},
'lessons_learned': 'Ongoing targeting of perimeter security appliances by '
'threat actors seeking persistent network access',
'post_incident_analysis': {'corrective_actions': 'Patch management, enhanced '
'monitoring for compromise '
'indicators',
'root_causes': 'Vulnerability in FortiOS '
'(CVE-2025-68686) allowing symlink '
'persistence bypass'},
'recommendations': ['Identify all FortiOS deployments and assess '
'internet-facing interfaces',
'Review Fortinet advisories for patches or mitigations',
'Investigate devices for signs of prior compromise, '
'including unauthorized logins, configuration changes, or '
'persistence artifacts',
'Isolate or decommission affected systems if no patch is '
'available'],
'references': [{'source': 'CISA KEV Catalog'}],
'regulatory_compliance': {'regulatory_notifications': 'Binding Operational '
'Directive 26-04 '
'(Federal agencies must '
'apply mitigations by '
'August 10, 2026)'},
'response': {'containment_measures': 'Isolate or decommission affected '
'systems if no patch is available',
'enhanced_monitoring': 'Review for unauthorized logins, '
'configuration changes, or persistence '
'artifacts',
'remediation_measures': 'Apply patches or mitigations as per '
'Fortinet advisories, investigate '
'devices for signs of prior compromise'},
'title': 'CISA Adds Actively Exploited Fortinet FortiOS Vulnerability '
'(CVE-2025-68686) to KEV Catalog',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'CVE-2025-68686 (Information Exposure - CWE-200)'}