DaystoPatch

FortinetExploited incident

FortiOS SSL-VPN symlink persistence patch bypass (information disclosure)

CVE-2025-68686Medium, CVSS 5.9In CISA's Known Exploited Vulnerabilities catalog since 27 Jul 2026

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statementUnverified source
Exposure
same day
First public report to first fixUnverified source
Follow-through
same day
First public report to a fix for every supported versionUnverified source
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date onlyUnverified: no archived copy, quote not checked yet

    Fortinet PSIRT FG-IR-25-934CuratedQuote not checked yet

    2026-02-10: Initial publication

    Reported to Fortinet under responsible disclosure (Peter Gabaldon, ITRESIT); the advisory is the first public signal found.

    Source
    Fortinet PSIRT FG-IR-25-934 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    CVE.org record CVE-2025-68686ClaimedQuote verified10 Feb 2026, 15:39 UTC

    An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions,

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:10303f2598ea6798…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet11 Feb 2026, 13:55 UTC

    🔗 CVE : CVE-2025-52436, CVE-2025-55018, CVE-2025-62439, CVE-2025-62676, CVE-2025-64157, CVE-2025-68686, CVE-2026-21743, CVE-2026-22153

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-68686)ClaimedQuote verified27 Jul 2026

    Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

    Added to CISA's KEV catalog on 2026-07-27.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet27 Jul 2026, 21:01 UTC

    Arista's VeloCloud Orchestrator is exposed by default - no setting turns it off. CISA says it's exploited. 9 detections, 32 IOCs. Full analysis + IOCs: https:// intel.threadlinqs.com/threat/T

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame dayUnverified: no archived copy, quote not checked yet

    Fortinet PSIRT FG-IR-25-934CuratedQuote not checked yet

    2026-02-10: Initial publication

    Source
    Fortinet PSIRT FG-IR-25-934 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    date only+30d

    Fortinet PSIRT FG-IR-25-934 (timeline)CuratedQuote verified

    2026-03-12: Added IPS package info

    The update added the virtual patch 'FG-VD-60389.0day.' (FMWP db update 26.033). Upgrading was already available from 2026-02-10.

    Source
    Fortinet PSIRT FG-IR-25-934 (timeline) vendor advisory update
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a7d68ae1aca41e4b…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date onlysame day

    Fortinet PSIRT FG-IR-25-084 (Wayback snapshot 2026-01-13 17:18 UTC)CuratedQuote verified

    Upgrade to 7.6.4 or above

    R2: FortiOS 7.6.4 and 7.4.9, later than the 7.6.2 / 7.4.7 fixes for CVE-2025-68686, were already shipping on 2026-01-13, so the fixes existed before FG-IR-25-934 (2026-02-10). Upper bound: 7.6.2 and 7.4.7 shipped earlier still (release dates not verified).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:338c5fb341c93f94…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet PSIRT FG-IR-25-934CuratedQuote verified10 Feb 2026

    Upgrade to 7.6.2 or above

    The fixed builds (7.6.2, 7.4.7) shipped well before the advisory (silent fix); their release dates were not verified, so the advisory date is used. World is also the advisory date, so exposure is zero either way.

    Source
    Fortinet PSIRT FG-IR-25-934 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a7d68ae1aca41e4b…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Fortinet PSIRT FG-IR-25-084 (Wayback snapshot 2026-01-13 17:18 UTC)CuratedQuote verified

    Upgrade to 7.4.9 or above

    R2: both fixed branches (7.6, 7.4) had later builds available by 2026-01-13 (upper bound).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:338c5fb341c93f94…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet PSIRT FG-IR-25-934CuratedQuote verified10 Feb 2026

    Upgrade to 7.4.7 or above

    FortiOS 7.2, 7.0 and 6.4 are 'Migrate to a fixed release' (no fix) and are not counted.

    Source
    Fortinet PSIRT FG-IR-25-934 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a7d68ae1aca41e4b…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • FortiOS
How we built this timeline

Coordinated disclosure; the live advisory (fetched 22 Oct 2026) still says 'Known Exploited No'. The bug only matters after an attacker has already compromised the device via another vulnerability and planted the SSL-VPN symlink persistence described in Fortinet's April 2025 PSIRT blog ('analysis-of-threat-actor-activity').

Devices that never had SSL-VPN enabled are not affected. No public exploitation report was located;

KEV added 27 Jul 2026. The Wayback Machine was offline during research, so the initial advisory text could not be compared.

Related

Fortinet report card