- Medium 5.9
- Known exploited (CISA KEV)
CVE-2025-68686
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
Scores
The facts
- Published
- 10 February 2026
- Last changed
- 28 July 2026
- NVD status
- Analyzed
- Severity
- Medium, CVSS 5.9 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- Affects
- fortinet fortios
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 27 July 2026.
- EPSS
- 29.5% chance of exploitation activity in the next 30 days (percentile 98).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.