VeloCloud Orchestrator On-Prem - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/velocloud-orchestrator-on-prem/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 27 Jul 2026 17:24:27 +0000Fortinet FortiOS CVE-2025-68686 Sensitive Information Exposure Bypasshttps://feed.craftedsignal.io/briefs/2026-07-fortinet-fortios-cve-2025-68686/Mon, 27 Jul 2026 17:24:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-fortinet-fortios-cve-2025-68686/A remote unauthenticated attacker can exploit CVE-2025-68686 in Fortinet FortiOS to bypass a previously applied patch, allowing sensitive information exposure and enabling persistence post-exploitation, provided the product was already compromised at the filesystem level via another vulnerability.CVE-2025-68686 describes a sensitive information exposure vulnerability in Fortinet FortiOS that has been added to CISA's Known Exploited Vulnerabilities Catalog. This vulnerability allows a remote unauthenticated attacker to bypass a previously deployed patch designed to mitigate symbolic link persistency mechanisms in post-exploitation scenarios. Exploitation requires that the attacker has already compromised the FortiOS product at the filesystem level through a separate, unspecified vulnerability. By sending specially crafted HTTP requests, attackers can circumvent the existing patch, re-establish persistence, and potentially access sensitive information. This vulnerability is critical for organizations using FortiOS, as it enables adversaries to maintain a foothold and continue malicious activities even after initial attempts to remediate persistence have been made.

Attack Chain

  1. An attacker gains initial access to the Fortinet FortiOS product through an unspecified vulnerability, achieving filesystem-level compromise.
  2. The attacker establishes persistence using symbolic link mechanisms, which are later patched by the vendor.
  3. Despite the patch being applied, the attacker leverages their existing filesystem access.
  4. The attacker crafts and sends malicious HTTP requests specifically designed to target the bypass vulnerability.
  5. The crafted HTTP requests exploit CVE-2025-68686, bypassing the patch intended to prevent symbolic link persistency.
  6. The symbolic link persistency mechanism is re-enabled or maintained, allowing the attacker to regain or sustain their persistent access.
  7. Through this persistence, the attacker can then access and potentially exfiltrate sensitive information from the compromised FortiOS device.

Impact

Successful exploitation of CVE-2025-68686 allows an attacker to bypass critical security patches, re-establish persistence, and expose sensitive information within compromised FortiOS environments. While this vulnerability requires prior filesystem-level compromise, its inclusion in CISA's KEV catalog signifies that it is either actively exploited or poses significant risk to federal agencies, implying a broader risk to all organizations utilizing affected FortiOS products. The impact includes continued unauthorized access, data breaches involving sensitive network configurations or user data, and potential for further network pivot from the FortiGate device.

Recommendation

  • Patch CVE-2025-68686 on all Fortinet FortiOS installations in accordance with vendor instructions provided in the FortiGuard PSIRT advisory FG-IR-25-934.
  • Review existing CISA BOD 26-04 guidance to ensure prioritization and adherence to patching deadlines for CVE-2025-68686, particularly for internet-exposed assets.
  • Implement CISA's Forensics Triage Requirements to ensure adequate logging and investigative capabilities are in place, particularly on systems where CVE-2025-68686 might have been exploited.
  • If unable to apply mitigations for CVE-2025-68686, consider discontinuing use of the affected FortiOS products or isolating them from critical networks.
]]>highthreatfortinetfortiosvulnerabilitycveexposurepersistence