CVE-2025-68686

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-68686
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://fortiguard.fortinet.com/psirt/FG-IR-25-934 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686 US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
History

27 Jul 2026, 19:47

Type Values Removed Values Added
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686 - US Government Resource

27 Jul 2026, 18:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686 -

17 Jun 2026, 09:59

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de Exposición de Información Sensible a un Actor No Autorizado [CWE-200] en Fortinet FortiOS 7.6.0 a 7.6.1, FortiOS 7.4.0 a 7.4.6, FortiOS 7.2 en todas las versiones, FortiOS 7.0 en todas las versiones, FortiOS 6.4 en todas las versiones puede permitir a un atacante remoto no autenticado eludir el parche desarrollado para el mecanismo de persistencia de enlaces simbólicos observado en algunos casos post-exploit, a través de solicitudes HTTP manipuladas. Un atacante necesitaría primero haber comprometido el producto a través de otra vulnerabilidad, a nivel del sistema de archivos.

12 Feb 2026, 14:49

Type Values Removed Values Added
References () https://fortiguard.fortinet.com/psirt/FG-IR-25-934 - () https://fortiguard.fortinet.com/psirt/FG-IR-25-934 - Vendor Advisory
First Time Fortinet
Fortinet fortios
CPE cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

10 Feb 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-10 16:16

Updated : 2026-07-28 05:17

NVD link : CVE-2025-68686

Mitre link : CVE-2025-68686

CVE.ORG link : CVE-2025-68686

JSON object : View

Products Affected

fortinet

  • fortios
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor