CVE-2025-68686 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor

What is CVE-2025-68686?

CVE-2025-68686 is a medium-severity vulnerability in Fortinet Fortios, published on 10 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

Weakness: CWE-200

Which versions are affected by CVE-2025-68686?

It affects 1 product.

Products include Fortinet Fortios.

How do I fix CVE-2025-68686?

No fix has been published for CVE-2025-68686 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 Aug 2026.

Is CVE-2025-68686 being exploited?

Yes. Attackers have exploited CVE-2025-68686 in the wild since at least 27 Jul 2026.

Other vulnerabilities in Fortinet Fortios

• CVE-2024-23113 Fortinet Multiple Products Format String Exploited Critical 9.8
• CVE-2022-40684 Fortinet Multiple Products Authentication Bypass Exploited Critical 9.8
• CVE-2024-55591 Fortinet FortiOS and FortiProxy Authentication Bypass Exploited Critical 9.6
• CVE-2024-21762 Fortinet FortiOS Out-of-Bound Write Exploited Critical 9.6
• CVE-2022-42475 Fortinet FortiOS Heap-Based Buffer Overflow Exploited Critical 9.3

All Fortinet Fortios vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-839g-m33x-3w78.