FortiOS CVE-2025-68686: Bypass of Symlink Persistence Mitigation for Already Compromised Devices

FortiOS CVE-2025-68686: Bypass of Symlink Persistence Mitigation for Already Compromised Devices 1. Basic Information Article Name : CISA Adds Two Known Exploited Vulnerabilities to Catalog Source : CISA Publication Date : July 27, 2026 Original Link : https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog Related Sources : https://fortiguard.fortinet.com/psirt/FG-IR-25-934 https://nvd.nist.gov/vuln/detail/CVE-2025-68686 Related Entities : CVE-2025-68686, FortiOS, SSL-VPN, symlink persistence, CISA KEV Severity : Critical 2. Summary This is an actively exploited vulnerability. An attacker who has already compromised the FortiOS file system via another vulnerability can use a crafted HTTP request to bypass symlink persistence mitigations. This allows access to sensitive files through the SSL-VPN web interface even after an upgrade. 3. Attack Flow An attacker compromises FortiOS down to the file system level using another vulnerability or path. The attacker places a symlink pointing to out-of-bounds system files into the SSL-VPN related area. An administrator applies standard patches or firmware updates, but the malicious symlink or its recreation path remains. The attacker bypasses the mitigation using a crafted HTTP request via CVE-2025-68686. The attacker may read sensitive files such as configurations, credentials, and keys from the SSL-VPN web interface. The attacker may use the stolen information to continue VPN authentication, administrative access, and internal intrusion. 4. Attacker Position and Execution Location Initial compromise and symlink placement happen on the FortiGate/FortiOS device. Mitigation bypass and file reading occur externally via the SSL-VPN HTTP(S) interface. This CVE alone does not provide initial file system access to uncompromised devices. 5. Visibility for Victims and Administrators The device may look updated, but unauthorized symlinks can remain. Crafted HTTP requests to the SSL-VPN w