A Bug That Attacks Your Recovery Assumption
On July 27, CISA added CVE-2025-68686 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation, and set an August 10 remediation deadline for federal agencies under Binding Operational Directive 22-01. The flaw is an exposure-of-sensitive-information vulnerability in Fortinet FortiOS, scored a modest 5.3 on CVSS, that lets a remote unauthenticated attacker bypass a security patch designed to prevent the persistence of malicious symbolic links. The low score hides the real danger, because the value of this bug is not in the initial break. It is in defeating the cleanup that defenders trust after an earlier incident.
This matters because FortiGate appliances have been among the most heavily targeted edge devices of the past two years, and Fortinet previously shipped a fix specifically to stop attackers from re-reading configuration and credential data through symbolic links planted during an intrusion. CVE-2025-68686 reopens that door for an attacker who retains filesystem access. The strategic implication for security leaders is uncomfortable: an appliance you believe you remediated after a prior compromise may still be leaking secrets to a persistent adversary who anticipated your patch. Recovery integrity, and not just patch level, is the property under attack here.
How the Symlink Bypass Actually Works
The mechanics are narrow and specific. Fortinet has warned since 2025 that attackers who compromised a FortiGate through a separate flaw were planting symbolic links inside the SSL-VPN language-file directory, giving them read access to sensitive files even after the original vulnerability was patched. The vendor issued protections to detect and remove those links. CVE-2025-68686 lets an attacker send specially crafted HTTP requests to bypass that protection, so the persistence technique keeps working. The prerequisite is that the attacker has already obtained filesystem-level access through some other means, which is why the standalone CVSS is low.
Reading the score in isolation would lead you to deprioritize this, and that would be a mistake. The correct mental model is a persistence-and-exfiltration tool used late in an intrusion chain, not a front-door exploit. It is dangerous precisely for the organizations that were already breached and believe they have recovered. If you were among the many enterprises that patched a FortiGate emergency in the past eighteen months, this vulnerability is a direct signal to re-examine whether your remediation actually evicted the adversary, or merely closed the window they originally climbed through while they held the exit open.
The Timeline and What the KEV Deadline Signals
The remediation timeline is compressed. CISA confirmed active exploitation and published the KEV entry on July 27, giving federal civilian agencies until August 10 to remediate. Private-sector organizations are not bound by BOD 22-01, yet the KEV listing functions as an authoritative exploitation signal that most mature security programs mirror in their own patch SLAs. Fortinet has issued fixed FortiOS builds, and the remediation is to move affected FortiGate devices onto a patched train. The short federal window reflects CISA's assessment that this is being used in the wild right now, not a theoretical concern.
We treat a KEV addition as the moment a vulnerability graduates from your backlog to your incident queue. The practical read for CISOs is that August 10 is a reasonable internal target even for non-federal environments, and that patching alone does not close this one. Because the bug preserves a persistence mechanism, applying the fixed firmware stops future symlink bypasses but does not by itself remove links an attacker already planted or evict an adversary who already has filesystem access. Patch, then hunt. Treating the update as the finish line is exactly the assumption this vulnerability was built to exploit.
Edge Appliances Remain the Soft Underbelly
CVE-2025-68686 is one more entry in a long 2026 run of edge-device vulnerabilities under active attack, alongside the Arista VeloCloud command-injection flaw CISA listed the same week and a string of firewall and VPN bugs before it. The pattern is consistent: internet-facing security appliances run complex proprietary firmware, sit at the trust boundary, and hold the credentials and configuration that let an attacker pivot inward. When one is compromised, attackers invest in persistence because the device is both a foothold and a listening post. Symlink-based re-reads of configuration data are a direct expression of that incentive.
For enterprise architects, the durable lesson is to stop treating the firewall as a device you install and forget. Edge appliances need the same lifecycle rigor as production servers: a tracked firmware inventory, rapid patch cadence tied to vendor and KEV advisories, restricted management-plane exposure, and monitoring that can detect post-exploitation behavior on the device itself. The organizations that keep getting burned are the ones whose edge fleet is opaque, where nobody can say within an hour which appliances run which firmware. That opacity is the real vulnerability, and CVE-2025-68686 is just the latest bill for it.
What a CISO Should Do This Week
Start with inventory and patch. Identify every FortiGate and FortiOS instance, confirm its firmware version, and schedule affected devices onto the fixed build with August 10 as your internal deadline regardless of whether you are a federal entity. Restrict administrative and SSL-VPN exposure to the internet wherever the business allows, and enforce phishing-resistant MFA on all remote access. These are the baseline steps that shrink both the initial-access surface and the value of any persistence an attacker might be maintaining. Do not stop there, because for this particular flaw the patch is necessary but not sufficient.
Then hunt, especially on any appliance that was part of a prior FortiGate incident. Inspect the SSL-VPN language-file directory and related paths for unexpected symbolic links, review configuration and credential files for signs of unauthorized read access, and rotate every secret that lived on a suspect device, including VPN credentials and administrative accounts. Where you cannot achieve high confidence that an appliance is clean, rebuild it from known-good firmware and configuration rather than trusting a patch. The point of this vulnerability is that patched does not equal clean, and your remediation standard for edge devices should reflect that going forward.
