Loading story…
CISA added CVE-2025-68686 to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a Fortinet FortiOS flaw that exposes sensitive information and lets a remote unauthenticated attacker bypass a patch for a symbolic-link persistence mechanism using crafted HTTP requests. The agency set an August 10, 2026 remediation deadline for Federal Civilian Executive Branch agencies and directed organizations to apply Fortinet mitigations and review devices for signs of earlier compromise.
Fortinet’s advisory says the issue affects FortiOS 7.4.0-7.4.3, 7.2.5-7.2.7, 7.0.12-7.0.14, and 6.4.13-6.4.16, while 7.6 is not affected, and recommends upgrading to 7.4.4+, 7.2.8+, or 7.0.15+, or migrating from 6.4 to a fixed release. The company described the bug as an improper access control weakness tied to bypassing real-time file system integrity checking write protection, and noted that exploitation requires the appliance to have already been compromised at the filesystem level through another vulnerability or method, making it a post-compromise persistence and patch-bypass risk rather than an initial access vector.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
KISA published a security notice urging users to apply Fortinet updates for CVE-2025-68686, an information exposure flaw in FortiOS. The notice identified affected FortiOS branches and listed fixed releases or required migration paths for unsupported branches.
CISA updated its Known Exploited Vulnerabilities catalog to add CVE-2025-68686, a Fortinet FortiOS flaw described as an exposure of sensitive information issue that can let a remote unauthenticated attacker bypass a patch for a symbolic-link persistence mechanism on already-compromised devices. The catalog release timestamp changed to 2026-07-27T17:00:05.7269Z and set a remediation due date of 2026-08-10 for the Fortinet entry.
A CVE record was published for CVE-2025-68686, describing a medium-severity Fortinet FortiOS information disclosure flaw that could let a remote unauthenticated attacker bypass a patch for the symbolic-link persistence mechanism using crafted HTTP requests. The record noted exploitation requires the device to have already been compromised at the filesystem level through another vulnerability.
Fortinet initially published PSIRT advisory FG-IR-24-012 for an improper access control vulnerability in FortiOS that can bypass real-time file system integrity checking write protection. The advisory said exploitation requires prior write access to the underlying system and recommended upgrading to fixed FortiOS versions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
7 references tracked. Mallory keeps watching after this page renders.
boho.or.kr
Open sourcecybersecuritynews.com
Open sourcegithub.com
Open sourceacn.gov.it
Open sourcecve.org
Open sourcefortiguard.fortinet.com
Open sourcegov.br
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA has added two critical authentication bypass vulnerabilities, CVE-2025-59718 and CVE-2025-59719, affecting multiple Fortinet products—including FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager—to its Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation. These flaws stem from improper verification of cryptographic signatures in the FortiCloud Single Sign-On (SSO) mechanism, allowing unauthenticated attackers to bypass authentication via specially crafted SAML messages. Fortinet has released advisories and patches, and CISA has set a remediation deadline for federal agencies, urging immediate patching or, if not possible, discontinuation of affected products until mitigations are in place. The vulnerabilities are not enabled by default but can be activated during FortiCare registration unless administrators disable the relevant SSO toggle. Security researchers have observed exploitation attempts shortly after the patch release, highlighting the urgency for organizations to update their systems. CISA's guidance mandates compliance with BOD 22-01 for federal agencies, and all organizations using affected Fortinet products are strongly advised to apply patches or disable the vulnerable SSO feature to prevent unauthorized access to their networks.
Jun 29, 2026
A critical vulnerability, CVE-2025-64446, affecting Fortinet FortiWeb web application firewall devices has been actively exploited in the wild, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, present in FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, and earlier branches, allows unauthenticated remote attackers to bypass authentication and execute administrative commands via crafted HTTP or HTTPS requests. Attackers have leveraged this vulnerability to create unauthorized administrative accounts, such as "Testpoint" and "trader," enabling persistent and undetected access to affected systems. Fortinet has released patches in version 8.0.2 and equivalent updates, but exploitation continues against unpatched devices, exposing organizations to significant risk of compromise and data exposure. CISA's inclusion of CVE-2025-64446 in the KEV catalog underscores the urgency of remediation, especially for U.S. federal agencies, which have been mandated to patch vulnerable FortiWeb systems by November 21, 2025. The agency also strongly advises all organizations to prioritize remediation of this and other KEV-listed vulnerabilities to reduce exposure to active cyber threats. The vulnerability's exploitation highlights the ongoing risk posed by unpatched perimeter security devices and the importance of timely vulnerability management in defending against sophisticated attacks.
Jun 29, 2026
Fortinet disclosed multiple critical vulnerabilities in **FortiOS** and related products, including an authentication bypass in **FortiOS** and **FortiProxy** that can grant attackers **super-admin privileges** and is being **actively exploited in the wild**. The flaw can be triggered through specially crafted requests to the **Node.js websocket module** and affects FortiOS `7.0.0` through `7.0.16`, FortiProxy `7.2.0` through `7.2.12`, and FortiProxy `7.0.0` through `7.0.19`. Organizations were told to upgrade to FortiOS `7.0.17+`, FortiProxy `7.2.13+`, or FortiProxy `7.0.20+`, and to apply Fortinet’s recommended mitigations immediately. Separate Fortinet advisories also warned of critical flaws **CVE-2024-21762** and **CVE-2024-23113**, affecting **FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager**. **CVE-2024-21762** carries a **CVSS 9.6** rating, while **CVE-2024-23113** is rated **CVSS 9.8**; both require urgent patching to fixed versions identified by Fortinet. Fortinet and national cyber authorities said defenders should prioritize upgrades across exposed appliances, and for `CVE-2024-21762`, disabling the **SSL VPN** feature can reduce exposure until patches are applied.
Jun 29, 2026