43 techniques observed across 3 entries, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)
Initial Access TA0001
T1078.001Valid Accounts: Default Accounts×1
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components.
T1059.001Command and Scripting Interpreter: PowerShell×1
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
T1059.003Command and Scripting Interpreter: Windows Command Shell×2
Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.
T1059.004Command and Scripting Interpreter: Unix Shell×1
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.
Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.
Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.
Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within virtualization/sandbox environments or natively on host systems.
Adversaries may intentionally exclude certain files, folders, directories, file types, or system components from encryption or tampering during a ransomware or malicious payload execution. Some file extensions that adversaries may avoid encrypting include `.dll`, `.exe`, and `.lnk`.
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.
T1550.002Use Alternate Authentication Material: Pass the Hash×1
Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.
T1550.003Use Alternate Authentication Material: Pass the Ticket×1
Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.
An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
T1071.001Application Layer Protocol: Web Protocols×1
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.
Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options.
Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks.
researchInsikt Group: the same six-tool stack followed thirteen unrelated CVEs into Exchange, SharePoint, FortiOS, Cisco IOS XE, F5 BIG-IP, GeoServer and Apache Shiro
Recorded Future's Insikt Group published its H1 2026 Malware and Vulnerability Trends report on 3 September 2026, tracking 215 actively exploited CVEs in the first half of 2026, up 34% from 161 in H1 2025 (Recorded Future, 2026-09-03). Of those, 176 (82%) were network-accessible and 146 (68%) could be exploited without prior authentication; 142 of those 146 combined both properties, and 60 of 82 remote-code-execution CVEs combined network reachability, no authentication requirement and code execution in a single package (Recorded Future, 2026-09-03).
The report's most actionable finding for defenders is that post-exploitation tool-stack reuse persists across otherwise-unrelated initial-access vulnerabilities, regardless of vendor or product family (Recorded Future, 2026-09-03). A cluster the report designates StrikeShark applied an identical six-tool post-exploitation stack (SharkLoader, Cobalt Strike Beacon, FScan, Searchall, Pillager Stealer and SharpGPOAbuse) across thirteen separate CVEs spanning 2016 through 2025, reaching Microsoft Exchange, Microsoft SharePoint, Fortinet FortiOS, Cisco IOS XE, F5 BIG-IP, GeoServer and Apache Shiro (Recorded Future, 2026-09-03); SharkLoader itself was previously profiled by Kaspersky's GReAT, which found it deploying Cobalt Strike via "Perfect DLL Hijacking" in a campaign whose confirmed victims spanned government and diplomatic entities, software developers and organizations in several other sectors and regions (Kaspersky Securelist, 2026-06-24). Separately, Storm-1175 linked Mimikatz, Impacket, PsExec, Rclone and Medusa ransomware across ten different initial CVEs; a China-linked cluster the report designates SHADOW-EARTH-053 separately reused Mimikatz following exploitation of CVE-2021-26855 in Microsoft Exchange Server (Recorded Future, 2026-09-03). Insikt Group mapped 114 of the 215 CVEs to MITRE ATT&CK: exploitation of a public-facing application was associated with 77 CVEs (68%), and 50 of those 77 also co-occurred with PowerShell, Windows Command Shell or Unix Shell execution; every one of the 28 web-shell-associated CVEs also carried the public-facing-application technique. The next most frequently associated post-exploitation behaviors across the mapped CVEs were system-information discovery, collection of data from the local system, transfer of further tooling into the compromised environment, and exfiltration over the command-and-control channel or web-protocol-based C2 traffic (Recorded Future, 2026-09-03).
The report's own defender-facing conclusion is explicit: because the same limited tool stack recurs regardless of which vulnerability supplied the initial foothold, detection engineering should chain exploitation telemetry from public-facing systems through to the post-exploitation behaviors these clusters repeat (credential dumping, remote-service execution via native administration mechanisms, bulk outbound data transfer, and ransomware staging) rather than treating each CVE alert as an isolated, one-off event (Recorded Future, 2026-09-03).
Threat actors reused post-exploitation playbooks across different initial vulnerabilities; StrikeShark applied the same six-tool stack across thirteen CVEs, while Storm-1175 linked credential theft, remote execution, data transfer, and ransomware tooling across ten.
In the StrikeShark campaign, SharkLoader, Cobalt Strike Beacon, FScan, Searchall, Pillager Stealer, and SharpGPOAbuse were linked to the same thirteen CVEs. Those vulnerabilities spanned 2016 through 2025 and affected Microsoft Exchange and SharePoint, Fortinet FortiOS, Cisco IOS XE, F5 BIG-IP, GeoServer, Apache Shiro, and other public-facing technologies.
50 of the 77 CVEs associated with the exploitation of public-facing applications were also linked to PowerShell, Windows Command Shell, or Unix Shell, and all 28 web-shell-associated CVEs also included T1190.
Six authorities (the FBI, CISA, the Department of Defense Cyber Crime Center, the NSA, the US Secret Service and the Republic of Korea's National Police Agency) published a joint #StopRansomware advisory on Gunra on 2026-08-10 (CISA et al., 2026-08-10). Gunra first appeared in April 2025 and is, in the authoring agencies' assessment, based on or significantly influenced by the Conti source code leaked in 2022; as of January 2026 it runs a structured affiliate programme advertised on criminal forums, supplying a management panel, a configurable builder, cross-platform lockers and affiliate documentation, and the FBI records the group also operating under the name Golden Community and recruiting penetration testers as initial-access brokers (CISA et al., 2026-08-10). The victim set on the group's leak site spans the Americas, Europe, the Middle East, Africa and Asia-Pacific, and the advisory names government services and facilities, utilities, healthcare, financial services, critical manufacturing and transport among the affected sectors, which is why this reads directly onto the European public-sector and critical-infrastructure estate, not only onto its Korean and American case studies.
Initial access is the edge appliance. The FBI observed Gunra obtaining access primarily by exploiting known vulnerabilities in internet-facing firewall and VPN appliances, specifically the FortiOS and FortiProxy authentication-bypass flaws CVE-2024-55591 and CVE-2025-24472, both CWE-288 (CISA et al., 2026-08-10). The advisory points at the CVE records rather than restating affected versions, and it is explicit about what the exploitation buys: those two flaws let an actor abuse scheduled tasks on a vulnerable FortiOS firewall to create a new persistent super-user account named forticloud-sync carrying a hard-coded password (CISA et al., 2026-08-10). That account name is the cheapest hunt in this advisory: an appliance administrator enumeration that finds it has found an intrusion, and finding it after patching means the patch did not evict anyone. Separately, KNPA observed initial access through credential-exposure and SSH access-control weaknesses on internet-facing VPN gateways, and in one case through an SSL-VPN administrator account reachable with default credentials because no account-lockout control was configured.
The identity plane is where the intrusion becomes durable. After taking a network administrator's workstation and the SSL-VPN administrative console, the actors located an unused account with reach into both the internet-facing and internal networks and modified its configuration to bypass the mandatory password-change requirement, then used it (CISA et al., 2026-08-10). Against one victim they manipulated the traffic-control functionality of the SSL-VPN appliance itself to collect the credentials and session material users were sending to a corporate VDI authentication portal, then replayed the captured session cookies to impersonate legitimate users. Against the same victim they went one step further and edited the authentication-processing files on that VDI authentication portal server so that a specific attacker-chosen one-time-password value would always authenticate successfully, a standing MFA bypass rather than a stolen token. Credential access elsewhere is conventional but thorough: secretsdump.py against domain controllers to pull hashes out of NTDS for pass-the-hash and pass-the-ticket movement, psexec.py and smbclient.py over SMB for lateral movement, RDP into the VDI estate, and in one case theft of a symmetric key from a system access-control server that decrypted the stored passwords for every enterprise server account.
Behavioural shape, in telemetry terms. The operators work deliberately unsociable hours (the advisory records reconnaissance and internal activity concentrated between 22:00 and 06:00 to avoid administrator attention) and clear system and network access logs and shell command history behind them (CISA et al., 2026-08-10). Collection and exfiltration precede encryption: business documents, databases, personal data and internal mail are staged, a purpose-built executable pulls data out of Microsoft OneDrive and SharePoint, and for at least one victim compressed archives running to tens of terabytes went to a consumer file-sharing service, with 7-Zip, RClone and FileZilla among the tools observed on the group's own infrastructure. Recovery is attacked directly: volume shadow copies are deleted through WMI from a command shell before encryption, and against one victim backup and archive data was deleted at both the primary data centre and the disaster-recovery site, before and after deployment. The encryptor itself enumerates every drive letter through the native file-enumeration APIs, skips system directories and system-critical file extensions so the host stays bootable and the ransom note stays readable, checks for a debugger, and encrypts the surviving user data multi-threaded with ChaCha20 and RSA-4096, appending .ENCRT. Ransom notes land per directory and route victims to a Tor negotiation portal and an encrypted messenger with a five-to-seven-day clock.
The one piece of genuinely good news is a cryptographic mistake. The advisory records that as of March 2026 researchers identified a weakness in the Linux ELF variants, which append .GNRA: the encryption keys come from a weak pseudo-random generator seeded with the predictable srand(time(NULL)), and defenders may use that to mathematically reconstruct the keys from file timestamps and recover files without paying (CISA et al., 2026-08-10; original research at Breakglass Intelligence, 2026-03-12). This has an operational consequence that cuts against normal incident-response reflex: the advisory's own instruction, for a Gunra Linux incident where encryption has happened, is to preserve the encrypted files, their timestamps, the ransom notes and the system logs, because a rebuild-from-backup-and-move-on response throws away the timestamps the key reconstruction depends on. No such weakness is recorded for the Windows encryptor.
Detection concepts. Three of this actor's behaviours produce durable, vendor-neutral signal. In edge-appliance administrative logs and configuration audit trails, surface any newly created administrative or super-user account and any change that clears a mandatory-password-change flag on a dormant account; both are the advisory's stated persistence steps, and both are visible in configuration state rather than in transient telemetry. In authentication-server change control, file-integrity monitoring over the authentication-processing components of VDI, SSL-VPN and SSO portals is the only control that sees the OTP backdoor at all; it produces no failed logins, no impossible travel and no anomalous token, because from the portal's point of view the authentication genuinely succeeded. In endpoint process telemetry with parent lineage, the shadow-copy deletion is a command shell invoking the WMI command-line utility with a shadowcopy delete operation, and the credential-dumping and lateral-movement steps present as the Impacket family's characteristic service-creation-over-SMB and NTDS access patterns on domain controllers.
Triage: the tooling here is deliberately dual-use (remote-access and archiving utilities that administrators run legitimately every day) so presence alone is not the signal and the advisory says as much. The discriminators are contextual: the same remote-access agent installed on a host that has no help-desk ticket behind it, an archiving utility writing multi-gigabyte archives on a file server at 03:00, an account whose password-change requirement was cleared without a change record, and (the sharpest one) a successful multi-factor authentication in which the presented one-time-password value is identical across sessions or across users. Legitimate one-time codes never repeat; that is the whole property they exist for.
primarily through the exploitation of known vulnerabilities in internet-facing devices
create a new, malicious persistent user forticloud-sync with super user privileges and a hard-coded password
the Gunra actors modified authentication processing files on the corporate VDI authentication portal server to allow successful authentication when a specific, Gunra-designated one time password (OTP) value was entered, thereby enabling the continuous bypass of multi-factor authentication (MFA)
Defenders may leverage this to mathematically reconstruct the keys using file timestamps and recover files without paying the ransom.
Gunra ransomware appears to be based on, or significantly influenced by, the Conti ransomware source code leaked in 2022.
CISA added CVE-2025-68686 to its Known Exploited Vulnerabilities catalog on 2026-07-27 (CISA, 2026-07-27). The flaw itself is not new (Fortinet published FG-IR-25-934 on 2026-02-10) but the KEV listing is the first assertion that it is being used against devices in the field, and it changes the disposition of a class of FortiGate estates that were considered remediated.
What the flaw does is narrow and precisely stated: it is an exposure of sensitive information (CWE-200) in FortiOS SSL-VPN that "may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests", and Fortinet is explicit that "[a]n attacker would need first to have compromised the product via another vulnerability, at filesystem level" (Fortinet PSIRT, 2026-02-10). In other words it is a persistence-and-evasion primitive layered on top of an earlier intrusion, not a way in. The operational consequence runs the other way from the modest severity score: the symlink technique it restores is the one Fortinet documented in April 2025, where an attacker who had reached the root filesystem achieved persistence "via creating a symbolic link connecting the user filesystem and the root filesystem in a folder used to serve language files for the SSL-VPN", so that "even if the customer device was updated with FortiOS versions that addressed the original vulnerabilities, this symbolic link may have been left behind, allowing the threat actor to maintain read-only access to files on the device's file system, which may include configurations" (Fortinet PSIRT, 2025-04-10). Fortinet's fix for that technique is what this CVE defeats, so a FortiGate whose response consisted of "patch the CVE, confirm the symlink fix is in place, close the ticket" may not in fact have evicted the attacker.
Scope is broad on the older branches. Fortinet lists FortiOS 7.6.0 through 7.6.1 (fixed in 7.6.2), 7.4.0 through 7.4.6 (fixed in 7.4.7), and 7.2, 7.0 and 6.4 as affected in all versions with migration to a fixed release as the only remediation; a virtual patch is available in FMWP database update 26.033, and devices that never had SSL-VPN enabled are out of scope (Fortinet PSIRT, 2026-02-10).
Detection is filesystem-integrity work on the appliance rather than network detection, because the abuse rides ordinary HTTPS to the SSL-VPN web listener and will not look anomalous in flow telemetry. The concrete hunt is an inventory question first: which FortiGates ran SSL-VPN while exposed to an earlier root-filesystem flaw, and of those, which show symbolic links in the SSL-VPN language-file directories that resolve outside the user filesystem, or drift in the language-pack files against a known-good image, that directory being the location Fortinet named when it first documented the technique (Fortinet PSIRT, 2025-04-10). Because the read access this restores is passive, the absence of outbound anomalies is not evidence of cleanliness; the discriminator is the presence of the link itself, not any traffic it produces. For estates that cannot immediately move off 7.2, 7.0 or 6.4, disabling SSL-VPN where it is not operationally required removes the component entirely, which is stronger than the virtual patch and follows directly from Fortinet's own scoping note that non-SSL-VPN deployments are unaffected.
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] in FortiOS SSL-VPN may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
This vulnerability can only be abused as a consequence of a threat actor exploiting a known vulnerability to implement read-only access to vulnerable FortiGate devices, at file system level.
Products that never had SSL-VPN enabled, are not impacted by this issue.
This was achieved via creating a symbolic link connecting the user filesystem and the root filesystem in a folder used to serve language files for the SSL-VPN.