FortiOS SSL-VPN symlink-persistence patch bypass (exploited, KEV)

CVE-2025-68686 — FortiOS SSL-VPN: the fix for the symlink-persistence technique is itself bypassable, and CISA now lists it as exploited

CISA added CVE-2025-68686 to its Known Exploited Vulnerabilities catalog on 2026-07-27 (CISA, 2026-07-27). The flaw itself is not new — Fortinet published FG-IR-25-934 on 2026-02-10 — but the KEV listing is the first assertion that it is being used against devices in the field, and it changes the disposition of a class of FortiGate estates that were considered remediated.

What the flaw does is narrow and precisely stated: it is an exposure of sensitive information (CWE-200) in FortiOS SSL-VPN that "may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests", and Fortinet is explicit that "[a]n attacker would need first to have compromised the product via another vulnerability, at filesystem level" (Fortinet PSIRT, 2026-02-10). In other words it is a persistence-and-evasion primitive layered on top of an earlier intrusion, not a way in. The operational consequence runs the other way from the modest severity score: the symlink technique it restores is the one Fortinet documented in April 2025, where an attacker who had reached the root filesystem achieved persistence "via creating a symbolic link connecting the user filesystem and the root filesystem in a folder used to serve language files for the SSL-VPN" — so that "even if the customer device was updated with FortiOS versions that addressed the original vulnerabilities, this symbolic link may have been left behind, allowing the threat actor to maintain read-only access to files on the device's file system, which may include configurations" (Fortinet PSIRT, 2025-04-10). Fortinet's fix for that technique is what this CVE defeats, so a FortiGate whose response consisted of "patch the CVE, confirm the symlink fix is in place, close the ticket" may not in fact have evicted the attacker.

Scope is broad on the older branches. Fortinet lists FortiOS 7.6.0 through 7.6.1 (fixed in 7.6.2), 7.4.0 through 7.4.6 (fixed in 7.4.7), and 7.2, 7.0 and 6.4 as affected in all versions with migration to a fixed release as the only remediation; a virtual patch is available in FMWP database update 26.033, and devices that never had SSL-VPN enabled are out of scope (Fortinet PSIRT, 2026-02-10).

Detection is filesystem-integrity work on the appliance rather than network detection, because the abuse rides ordinary HTTPS to the SSL-VPN web listener and will not look anomalous in flow telemetry. The concrete hunt is an inventory question first: which FortiGates ran SSL-VPN while exposed to an earlier root-filesystem flaw, and of those, which show symbolic links in the SSL-VPN language-file directories that resolve outside the user filesystem, or drift in the language-pack files against a known-good image — that directory being the location Fortinet named when it first documented the technique (Fortinet PSIRT, 2025-04-10). Because the read access this restores is passive, the absence of outbound anomalies is not evidence of cleanliness — the discriminator is the presence of the link itself, not any traffic it produces. For estates that cannot immediately move off 7.2, 7.0 or 6.4, disabling SSL-VPN where it is not operationally required removes the component entirely, which is stronger than the virtual patch and follows directly from Fortinet's own scoping note that non-SSL-VPN deployments are unaffected.