Actively exploited in the wild
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Fortinet - FortiOS · Listed in the CISA KEV since 2026-07-27. This indicates confirmed attacks in production environments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2025-68686
MediumCVSS 5.9KEVExploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
A vulnerability in Fortinet FortiOS allows a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases. The attack requires prior compromise of the product via another vulnerability at the filesystem level.
Risk Assessment
The risk is the ability to bypass security measures and maintain persistent access after an initial breach, potentially leading to long-term compromise.
Recommendation
Immediately update FortiOS to a patched version and implement additional filesystem integrity monitoring mechanisms.
Other vulnerabilities in FortiOS
See all- CVE-2015-7361High
FortiOS version 5.2.3, when configured for High Availability (HA) with the dedicated management interface enabled, does not require authentication for access to the ZebOS shell on this interface. This allows remote attackers to gain shell access via unspecified vectors.
- CVE-2025-24472HighActively exploited
An authentication bypass vulnerability in FortiOS and FortiProxy allows a remote unauthenticated attacker, with prior knowledge of upstream and downstream device serial numbers, to gain super-admin privileges on the downstream device if Security Fabric is enabled. The attack is carried out via crafted CSF proxy requests.
- CVE-2024-55591CriticalActively exploited
An authentication bypass vulnerability in FortiOS and FortiProxy using an alternate path or channel. A remote attacker can gain super-admin privileges by sending crafted requests to the Node.js websocket module.
- CVE-2023-42789Critical
An out-of-bounds write vulnerability in Fortinet FortiOS, FortiProxy, and FortiSASE allows an attacker to execute unauthorized code or commands via specially crafted HTTP requests.
- CVE-2022-40684CriticalActively exploited
An authentication bypass vulnerability in FortiOS, FortiProxy, and FortiSwitchManager allows an unauthenticated attacker to perform operations on the administrative interface via crafted HTTP or HTTPS requests.
- CVE-2019-5591MediumActively exploited
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
- CVE-2020-12812CriticalActively exploited
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.
- CVE-2019-6693MediumActively exploited
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
- CVE-2026-71408Medium
Fortinet FortiOS versions 7.6.0-7.6.6, 7.4 (all), and 7.2 (all) have a vulnerability of resource allocation without limits or throttling, which may allow an attacker to cause denial of service.
- CVE-2026-71407Medium
Fortinet FortiOS versions 7.6.1-7.6.6 have a stack-based buffer overflow vulnerability (CWE-121) that may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon, but only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled.
Original NVD description (English source)
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.