Fortinet FortiOS: Patch bypass for symlink persistence in SSL-VPN
Deadline for US federal agencies: 10 Aug 2026
Summary
FortiOS SSL-VPN contains an information exposure flaw (CWE-200) that allows a remote, unauthenticated attacker to bypass the patch for the symbolic link persistence mechanism that was observed in post-exploitation cases. The attacker sends crafted HTTP requests, which can expose sensitive information. The attacker must first have compromised the device through another vulnerability at filesystem level. CISA has added the flaw to its Known Exploited Vulnerabilities catalog.
Affected
- FortiOS 7.6.0 through 7.6.1
- FortiOS 7.4.0 through 7.4.6
- FortiOS 7.2, 7.0 and 6.4: all versions according to the FortiGuard advisory (the CVE record lists 7.2.0 to 7.2.13, 7.0.0 to 7.0.19 and 6.4.0 to 6.4.16)
- Products without SSL-VPN enabled are not affected.
Fixed in
- FortiOS 7.6: upgrade to 7.6.2 or above
- FortiOS 7.4: upgrade to 7.4.7 or above
- FortiOS 7.2, 7.0 and 6.4: migrate to a fixed release (the fixed version is not named in the advisory; unknown)
Workaround
- Virtual patch "FG-VD-60389.0day" in FMWP database update 26.033. Fortinet has not clearly stated which products it applies to; confirm with Fortinet before relying on it.
- If SSL-VPN is not required, disable it.
Exploitation
- CISA KEV: added 2026-07-27, due date 2026-08-10. Known to be used in ransomware campaigns: unknown.
- Active exploitation is reported (CISA KEV, HKCERT).
- No public proof of concept found in research; this does not prove none exists.
Our recommendation
- Upgrade to FortiOS 7.6.2 or above, or 7.4.7 or above. Migrate the 7.2, 7.0 and 6.4 branches to a fixed release.
- Check all internet-exposed SSL-VPN devices for prior compromise: unauthorized filesystem changes, unexpected symbolic links, anomalous SSL-VPN activity, unauthorized configuration changes and suspicious administrative access.
- Rotate credentials if compromise is suspected. Patching alone may not remove an existing attacker foothold.
- Disable SSL-VPN if it is not needed.
- Monitor SSL-VPN logs and administrative access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fortinet PSIRT FG-IR-25-934 fortiguard.fortinet.com
- CISA Known Exploited Vulnerabilities Catalog: CVE-2025-68686 www.cisa.gov
- HKCERT security bulletin: Fortinet products multiple vulnerabilities www.hkcert.org
- Redlegg security bulletin: SSL-VPN symlink persistence patch bypass in FortiOS www.redlegg.com
- CybersecurityNews: Fortinet FortiOS vulnerability exploited cybersecuritynews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:03.
Original description (NVD)
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.