CVE-2025-68686KEV · OVERDUECWE-200

Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Medium · published February 10, 2026

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 5.3. It is confirmed in active exploitation. It sits in the 98.2th percentile for exploit probability.

74
days past CISA
deadline
CVSS v3.1
5.3
EPSS
29%
Percentile
98.2
In the wild
Confirmed
What it is

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.29499 · 98.2th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-02-10T15:39Z
KEV added
2026-07-27 · due 2026-08-10
EPSS history
Timeline
  • 27 JUL 00:00Z
    Added to CISA KEV — remediate by Aug 10
    kev
  • 10 FEB 15:39Z
    An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0…
    cvelistv5