---
title: "FortiOS CVE-2025-68686: SSL-VPN Symlink Patch Bypass in KEV"
url: https://erroneo.us/security/briefs/fortios-ssl-vpn-symlink-patch-bypass-cve-2025-68686/
description: "Post-compromise FortiOS flaw lets attackers keep read access via the old SSL-VPN symlink trick. Fixed in 7.6.2/7.4.7; 7.2 and older must migrate."
type: security-brief
section: "Security Digest"
date_published: 2026-02-10
date_modified: 2026-07-27
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-68686"]
severity: "medium"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# FortiOS CVE-2025-68686: SSL-VPN Symlink Patch Bypass in KEV

**Verdict: Check exposure.** This is not a way in, only a way to stay in on FortiGates that ran SSL-VPN and were already breached; the real problem is that FortiOS 7.2, 7.0 and 6.4 will never get a fix, so plan the move to 7.4.7+ or 7.6.2+.

- **Who must act:** FortiGate owners on FortiOS 6.4, 7.0, 7.2, 7.4 before 7.4.7 or 7.6 before 7.6.2 whose devices have ever had SSL-VPN enabled, above all units that were exposed to older SSL-VPN bugs.
- **Who can relax:** FortiGates that never had SSL-VPN enabled (Fortinet says they are not impacted), devices already on 7.4.7+ or 7.6.2+, and teams with no Fortinet gear.
- **Affected:** FortiOS 7.6.0 through 7.6.1; FortiOS 7.4.0 through 7.4.6; FortiOS 7.2 (all versions); FortiOS 7.0 (all versions); FortiOS 6.4 (all versions)
- **Fixed:** FortiOS 7.6.2 or later; FortiOS 7.4.7 or later; FortiOS 7.2, 7.0 and 6.4: no fix, migrate to a fixed branch; Interim: IPS virtual patch FG-VD-60389.0day (FMWP db update 26.033)
- **CVEs:** CVE-2025-68686
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run get system status on every FortiGate and list units on 6.4, 7.0, 7.2, 7.4 before 7.4.7 or 7.6 before 7.6.2.
2. Upgrade to FortiOS 7.4.7+ or 7.6.2+ using Fortinet's upgrade path; 7.2, 7.0 and 6.4 have no fix and must migrate.
3. Until then, keep the AV/IPS engine licensed and enabled and apply the FG-VD-60389.0day virtual patch.
4. If a unit ran SSL-VPN while vulnerable to older FortiOS bugs, treat its configuration as exposed and rotate admin, VPN, LDAP and RADIUS secrets and certificates.
5. Turn SSL-VPN off on devices that do not need it.

### How to check if you are affected

- Follow Fortinet's April 2025 symlink guidance: the persistence artifact is a link in the SSL-VPN language-file folder that points into the root filesystem, and upgrading to a fixed build removes it.
- Review SSL-VPN web logs for unexpected HTTP requests from unfamiliar sources; no CVE-specific indicators had been published as of Oct 21, 2026.
- Treat any FortiGate that ran SSL-VPN while unpatched for FG-IR-22-398, FG-IR-23-097 or FG-IR-24-015 as possibly compromised and follow Fortinet's recovery steps.

## What happened

In April 2025, Fortinet [disclosed](https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity) that an attacker had used known FortiOS vulnerabilities to plant a symbolic link in the folder that serves SSL-VPN language files. The link connected the user filesystem to the root filesystem and survived firmware upgrades. That left the attacker with read-only access to files, configurations included, even after the original bugs were patched. Fortinet's fix removed the link in FortiOS 7.6.2, 7.4.7, 7.2.11, 7.0.17 and 6.4.16 and changed the SSL-VPN interface so it would no longer serve such links.

On February 10, 2026, Fortinet published [FG-IR-25-934](https://fortiguard.fortinet.com/psirt/FG-IR-25-934), "SSL-VPN Symlink Persistence Patch Bypass," assigned CVE-2025-68686. A remote, unauthenticated attacker can get around that fix with crafted HTTP requests. The catch is that the attacker "would need first to have compromised the product via another vulnerability, at filesystem level." Peter Gabaldon of ITRESIT reported the flaw. Fortinet scores it CVSS 3.1 5.9 (Medium), with a temporal score of 5.3, and its advisory marks it "Known Exploited: No."

CISA disagreed on the exploitation point. It added CVE-2025-68686 to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686) on July 27, 2026, with a federal deadline of August 10. [Coverage of the addition](https://securityaffairs.com/196130/security/u-s-cisa-adds-arista-velocloud-orchestrator-and-fortinet-fortios-flaws-to-its-known-exploited-vulnerabilities-catalog.html) names no attacker or campaign. Neither CISA nor Fortinet had published details of the activity as of October 21, 2026.

## Who is affected

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-68686) lists FortiOS 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, and every version of 7.2, 7.0 and 6.4. The fixed releases are 7.6.2 and 7.4.7. For 7.2, 7.0 and 6.4, Fortinet's only remedy is "migrate to a fixed release." In other words, the 2025 builds that removed the symlink on those branches (7.2.11, 7.0.17, 6.4.16) do not close this bypass, and no fix is coming for them. Fortinet says products that never had SSL-VPN enabled are not impacted. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-68686) carries only Fortinet's 5.9 score.

## Do you really need to act?

Most organizations need no emergency response here, but many FortiGate fleets need a plan. The bug is a persistence aid, not an entry point. It matters if an attacker already reached your device's filesystem, most plausibly during the older SSL-VPN exploitation waves Fortinet cites (FG-IR-22-398, FG-IR-23-097 and FG-IR-24-015). In that case, read access to a FortiGate configuration exposes VPN users, LDAP bind credentials, admin hashes and certificates. You usually cannot prove that a device which ran exposed SSL-VPN through those years was never touched, so the practical question is which branch you are on.

- **On 7.4.7+ or 7.6.2+:** no action for this CVE.
- **On 7.2, 7.0 or 6.4 with SSL-VPN ever enabled:** schedule a move to a supported fixed branch this month, and rotate secrets if the device was ever behind on SSL-VPN patches.
- **SSL-VPN never enabled:** not affected.

## What to do now

1. Run `get system status` on each FortiGate (or pull versions from FortiManager) and flag any unit below 7.4.7 or 7.6.2.
2. Upgrade to 7.4.7+ or 7.6.2+ following Fortinet's recommended upgrade path. Units on 7.2, 7.0 and 6.4 need a branch migration, which may mean hardware or license planning.
3. Until you can upgrade, confirm with `diagnose autoupdate versions` that AV/IPS definitions are current. Fortinet says the engine flags the 2025 symlink as malicious on 7.4, 7.2, 7.0 and 6.4 when licensed and enabled. Apply the virtual patch FG-VD-60389.0day from FMWP database update 26.033.
4. If SSL-VPN on the unit was ever exposed while it was unpatched, rotate administrator passwords, VPN and LDAP/RADIUS secrets, and certificates.
5. Disable SSL-VPN where it is not needed, and keep management access off the internet.

## How to tell if you were hit

Fortinet's 2025 analysis describes the artifact as a symbolic link in the SSL-VPN language-file folder that points into the root filesystem. Upgrading to a fixed build removes it, and Fortinet recommends reviewing every device's configuration and treating it as potentially compromised. No indicators specific to CVE-2025-68686 had been published as of October 21, 2026. Review SSL-VPN web logs for unexpected requests from unfamiliar sources. If a unit missed earlier SSL-VPN patches, open a case with Fortinet support and follow its recovery steps instead of relying on an upgrade alone.

## Timeline

- Apr 10, 2025 — Fortinet discloses the SSL-VPN symlink persistence technique and ships builds that remove the link.
- Feb 10, 2026 — FG-IR-25-934 / CVE-2025-68686 published, with fixes in 7.6.2 and 7.4.7.
- Mar 12, 2026 — Fortinet adds IPS virtual-patch details to the advisory.
- Jul 27, 2026 — CISA adds CVE-2025-68686 to KEV, with an August 10 deadline.

## Sources

1. [Fortinet PSIRT — FG-IR-25-934: SSL-VPN Symlink Persistence Patch Bypass (CVE-2025-68686)](https://fortiguard.fortinet.com/psirt/FG-IR-25-934)
2. [Fortinet PSIRT blog — Analysis of Threat Actor Activity (Apr 10, 2025)](https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity)
3. [CVE record — CVE-2025-68686](https://www.cve.org/CVERecord?id=CVE-2025-68686)
4. [NVD — CVE-2025-68686](https://nvd.nist.gov/vuln/detail/CVE-2025-68686)
5. [CISA — Known Exploited Vulnerabilities: CVE-2025-68686](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686)
6. [Security Affairs — CISA adds Arista VeloCloud Orchestrator and Fortinet FortiOS flaws to KEV](https://securityaffairs.com/196130/security/u-s-cisa-adds-arista-velocloud-orchestrator-and-fortinet-fortios-flaws-to-its-known-exploited-vulnerabilities-catalog.html)

---
Source page: https://erroneo.us/security/briefs/fortios-ssl-vpn-symlink-patch-bypass-cve-2025-68686/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt