# CVE-2025-68686 — Fortinet FortiOS **CISA KEV** > As of 2026-07-28, CVE-2025-68686 is a MEDIUM-severity vulnerability in Fortinet FortiOS, CVSS v3.1 5.3, EPSS 0.4% (38.4th percentile). It is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-07-27), with a US federal remediation deadline of 2026-08-10. Threadlinqs Intelligence links 2 tracked threat campaigns to CVE-2025-68686, most recently “CISA Adds Two Known Exploited Vulnerabilities to Catalog: Fortinet FortiOS Information Disclosure (CVE-2025-68686) and Arista VeloCloud Orchestrator OS Command Injection (CVE-2026-16812)”. **Last updated:** 2026-07-28 ## What is CVE-2025-68686? An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level. The record classifies CVE-2025-68686 under weakness class [CWE-200](https://cwe.mitre.org/data/definitions/200.html). Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 214 days ago. ## Severity and exploitation probability - **CVSS v3.1 base score:** 5.3 — MEDIUM (`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C`) - **EPSS (FIRST):** 0.4% probability of exploitation in the next 30 days, higher than 38.4% of all scored CVEs - **CISA KEV:** Listed since 2026-07-27, federal remediation deadline 2026-08-10 - **Threadlinqs priority:** 9/10 — CISA KEV-listed, which Threadlinqs floors at 9 - **Published:** 2026-02-10, last modified 2026-07-28 ## Is CVE-2025-68686 being exploited? CISA added CVE-2025-68686 to the Known Exploited Vulnerabilities catalog on 2026-07-27, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2026-08-10 under BOD 22-01. It currently carries a trending score of 20 in the Threadlinqs vulnerability feed. ## Affected products and versions - **Fortinet**: FortiOS ## How to fix CVE-2025-68686 Because CVE-2025-68686 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2026-08-10. No vendor patch reference has been recorded for CVE-2025-68686 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise. ## Threat activity tracking CVE-2025-68686 2 tracked threats in the Threadlinqs corpus reference CVE-2025-68686, either in the campaign’s CVE list or as an indicator on the campaign record. - [CISA Adds Two Known Exploited Vulnerabilities to Catalog: Fortinet FortiOS Information Disclosure (CVE-2025-68686) and Arista VeloCloud Orchestrator OS Command Injection (CVE-2026-16812)](https://intel.threadlinqs.com/threat/TL-2026-1725) — CRITICAL · 2026-07-27 - [FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644 Devices, 194 Countries)](https://intel.threadlinqs.com/threat/TL-2026-1232) — CRITICAL · 2026-07-11 ## Sources Enriched from CVE.org, FIRST EPSS, CISA KEV, GitHub Security Advisories. Last verified by Threadlinqs on 2026-07-28. **Other references** - [fortiguard.fortinet.com](https://fortiguard.fortinet.com/psirt/FG-IR-25-934) Canonical: https://intel.threadlinqs.com/cve/CVE-2025-68686 Full detection coverage and IOCs for threats exploiting CVE-2025-68686 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp