FortiOS patch bypass re-enables symbolic link persistence on compromised devices
FortiOS 7.0–7.6 patch bypass restores symbolic link persistence on already-compromised devices via crafted HTTP requests. Added to CISA KEV July 2026.
- Vendor
- Fortinet
- Product
- FortiOS
- CVSS
- 5.9
- EPSS (exploit probability)
- 29.5%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2025-68686 being exploited?
Yes. CISA added CVE-2025-68686 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 29.5% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2025-68686 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (14 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2025-68686 covers a bypass of the patch Fortinet shipped for the symbolic link persistence mechanism observed in FortiOS post-exploitation. A remote unauthenticated attacker who has already compromised the target at the filesystem level — via another vulnerability — can send crafted HTTP requests to undo Fortinet’s own mitigation and restore that persistence channel. Source: Fortinet PSIRT advisory FG-IR-25-934 and NVD.
CISA added it to the Known Exploited Vulnerabilities catalog on July 27, 2026, confirming active exploitation in the wild.
Affected versions
FortiOS 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, and all versions of 7.2, 7.0, and 6.4 per NVD.
What to do
Check your running FortiOS version against the patched releases listed in FG-IR-25-934. If you’re on 7.2, 7.0, or 6.4, those branches are entirely in the affected range — that means upgrading to a patched major release, not patching within-branch.
If there’s any chance the device was compromised via another FortiOS vulnerability before this fix was applied — the 2025 SSL-VPN exploitation wave is the obvious candidate — treat it as potentially persistently backdoored and run the forensic triage outlined in CISA’s BOD 26-04 implementation guidance. Federal agencies under BOD 26-04 have a mandatory remediation deadline tied to this KEV addition.
Other Fortinet FortiOS CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2019-6693 Fortinet FortiOS Use of Hard-Coded Credentials Vulnerabilityransomware use | [ MEDIUM ] | 6.5 | 6.6% | |
| CVE-2024-21762 Fortinet FortiOS Out-of-Bound Write Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 84.6% | |
| CVE-2022-41328 Fortinet FortiOS Path Traversal Vulnerability | [ MEDIUM ] | 6.7 | 10.7% | |
| CVE-2022-42475 Fortinet FortiOS Heap-Based Buffer Overflow Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 99.5% | |
| CVE-2021-44168 Fortinet FortiOS Arbitrary File Download | [ LOW ] | 3.3 | 0.9% | |
| CVE-2020-12812 Fortinet FortiOS SSL VPN Improper Authentication Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 45.4% | |
| CVE-2019-5591 Fortinet FortiOS Default Configuration Vulnerabilityransomware use | [ MEDIUM ] | 6.5 | 18.6% | |
| CVE-2018-13379 Fortinet FortiOS SSL VPN Path Traversal Vulnerabilityransomware use | [ CRITICAL ] | 9.1 | 100.0% |
