Skip to content
Log inStart free trial

CVE-2025-68686

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0…

Medium Known exploited
Severity
5.9 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
29.50%
Chance of exploitation in the next 30 days. Higher than 98.19% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Jul 27, 2026
Weakness
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Fix
None yet
No fixed version published
Exploited in the wild. Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (Fortinet FortiOS). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Aug 10, 2026.

Description

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 5.9

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How to prevent it
  • Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Advisories

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Last updated by the source
  4. Remediation due for U.S. federal agencies
  5. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-j7qq-vr8c-xvw3
MLflow CrewAI autologging records LLM provider API keys in logged trace spans
Medium Same weakness, CWE-200
GHSA-gqh3-7856-rjjg
ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
Medium Same weakness, CWE-200
GHSA-rqgm-cfrp-4hx8
ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
Medium Same weakness, CWE-200
GHSA-f66c-mpj2-3r8h
ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
Medium Same weakness, CWE-200
GHSA-vfpm-58rq-9qcg
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Medium Same weakness, CWE-200
GHSA-23mf-xhv8-69c2
GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)
High Same weakness, CWE-200
GHSA-fx3j-rwgx-fr94
GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name
High Same weakness, CWE-200
GHSA-vp88-798v-h67f
rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert
Low Same weakness, CWE-200
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor