CVE-2025-68686: The “Double Slash” That Revives Your Patched FortiOS SSL-VPN Backdoor — CISA Deadline August 10

On July 27, 2026, the U.S. Cybersecurity and Infrastructure Security Agency quietly added another Fortinet flaw to its Known Exploited Vulnerabilities (KEV) catalog — and this one deserves far more attention than its “Medium” CVSS score suggests. CVE-2025-68686 is not a brand-new vulnerability in the traditional sense. It is something arguably more dangerous: a bypass of a patch Fortinet already issued to stop a known attack technique. In other words, organisations that believed they had fully remediated the FortiOS SSL-VPN symlink persistence threat may still be sitting wide open — without knowing it. Federal civilian agencies have until August 10, 2026 to apply fixes. For the rest of us, the clock is also ticking.

The SSL-VPN Symlink Attack: A Brief, Painful History

To understand CVE-2025-68686, you need to understand the attack chain it revives. Between 2022 and 2024, Fortinet disclosed a series of critical FortiOS vulnerabilities — CVE-2022-42475 (heap-based buffer overflow), CVE-2023-27997 (heap overflow in SSL-VPN), and CVE-2024-21762 (out-of-bounds write, CVSS 9.6) — each of which was actively exploited by sophisticated threat actors, including China-nexus APT groups tracked by multiple intelligence vendors.

The post-exploitation technique these attackers favoured was elegant in its simplicity: plant a symbolic link inside the SSL-VPN’s language directory pointing from the VPN user’s accessible filesystem directly into the root filesystem. Once that symlink was in place, any authenticated or sometimes even unauthenticated user could traverse the symlink and read sensitive files — think VPN credentials, configuration files, private keys — from the underlying FortiOS root.

Fortinet eventually released patches and issued advisory FG-IR-25-934 addressing the persistence mechanism. The mitigation checked for the string /lang/custom in incoming HTTP request paths and blocked access if detected. Many organisations patched, exhaled, and moved on. They should not have.

How CVE-2025-68686 Works: The Double-Slash That Defeats the Patch

The bypass at the heart of CVE-2025-68686 is almost insultingly simple. Fortinet’s mitigation performed a literal string match against request paths. The check looked for exactly /lang/custom. An attacker only had to send /lang//custom — a doubled slash — to evade the filter entirely.

Here is why it works: the web server normalises the path before routing the request. To the application server, /lang//custom/ and /lang/custom/ are identical. But to the string-matching mitigation sitting in front of it, they are completely different strings. The filter sees no match, passes the request through, and the web server happily serves whatever file the previously planted symlink points to.

Researchers have described it bluntly: “a doubled slash defeats a patch.” This is a textbook example of a patch bypass via inconsistent input normalisation — a class of vulnerability that has plagued web security for decades, and one that is especially dangerous when the bypassed patch was itself protecting against a critical information-disclosure path.

FortiOS Branch	Vulnerable Versions	Fixed Version
7.6	7.6.0 – 7.6.1	7.6.2+
7.4	7.4.0 – 7.4.6	7.4.7+
7.2	All versions	Latest patched release or migrate
7.0	All versions	Latest patched release or migrate
6.4	All versions	Latest patched release or migrate

A critical technical caveat: CVE-2025-68686 requires prior symlinks to already be present on the device. Attackers cannot use it to achieve initial access. They need to have previously compromised the appliance via one of the 2022–2024 vulnerabilities and planted a symlink that survived. However, research has confirmed that many organisations cleaned their firmware but never cleaned their filesystems. Those symlinks are still there, and CVE-2025-68686 now gives any attacker with HTTP/S access a way to exploit them — even on a device running a “patched” firmware version.

Why a “Medium” CVSS Score Can Kill You

CVSS 5.9 looks unimpressive. Most vulnerability management programs triage Medium findings below Critical and High ones. This is exactly the kind of prioritisation gap that sophisticated threat actors are counting on.

The misleading score stems from how CVSS accounts for prerequisites. Because this vulnerability requires prior compromise, the attack vector and complexity scores are elevated, pushing the CVSS down. But that mathematical penalty ignores a brutal operational reality: thousands of FortiGate appliances were compromised in 2022, 2023, and 2024 and were never forensically cleaned. The symlinks are there. The prerequisite has already been met — it was met years ago.

CISA’s decision to add CVE-2025-68686 to KEV reflects this operational reality. The catalog is not a CVSS leaderboard; it is a list of vulnerabilities that are demonstrably being used to harm real organisations right now. When CISA puts something in KEV with a short federal remediation window, the message is clear: ignore the CVSS score; read the KEV entry. This is the same pattern we saw recently with the FortiSandbox exploit chain where a staggered chain of flaws became devastating in combination.

The India Context — Your FortiGate Is a Target

India is one of the most heavily FortiGate-dependent countries in the world. From banking and telecom to government agencies and manufacturing, FortiGate firewalls are the perimeter device of choice across enterprise India. This exposure is not hypothetical: when the FortiBleed campaign was mapped in June 2026, India ranked among the top three countries for compromised Fortinet devices — a sobering reminder that being a high-volume FortiGate market also means being a high-value target.

Indian IT teams often lag on firmware upgrades due to change-management cycles, maintenance window constraints, and the misconception that a previous “security patch” already addressed a given risk. CVE-2025-68686 is a direct consequence of that lag: organisations that patched for CVE-2024-21762 in 2024 may still be running FortiOS 7.4.5 or 7.4.6, versions that remain fully vulnerable to this bypass. The fix requires upgrading to 7.4.7 or later — and then hunting for symlinks left by any prior compromise, regardless of firmware version.

This flaw was also added to the CISA KEV catalog alongside the Arista VeloCloud SD-WAN zero-day — a reminder that perimeter devices across vendors remain priority targets for both nation-state actors and ransomware operators who understand that owning the edge means owning everything behind it. And as the GoldenEyeDog DigiCert incident showed, even certificate-level trust is not guaranteed: perimeter compromise can cascade into identity and trust infrastructure.

What You Should Do Right Now — Sanjay’s Expert Playbook

Here is a prioritised response plan for any organisation running FortiOS with SSL-VPN enabled:

1. Patch immediately. Upgrade to FortiOS 7.6.2+ or 7.4.7+ (or the latest available patched release for your branch). Do not wait for your next scheduled maintenance window. The CISA deadline for federal agencies is August 10, 2026 — treat that as your deadline too.
2. Hunt for symlinks — even on patched devices. Run a forensic check of your SSL-VPN language directories. Look for unexpected symbolic links under /data/lib/dart/packages/ and equivalent paths. A clean firmware version does not remove artefacts planted by prior attackers. Patching stops future exploitation; it does not clean what is already there.
3. Rotate all credentials the device could have exposed. Any VPN credentials, admin passwords, certificates, or API keys that transited or were stored on an appliance that was previously compromised should be considered burned. Rotate them now, not after confirmation of breach.
4. Review admin account history. Look for unexplained administrator accounts, policy changes, or VPN user additions made during the 2022–2024 window. These are classic post-compromise persistence indicators.
5. Disable SSL-VPN if it is not operationally required. If your users can access resources through IPsec or a Zero Trust Network Access (ZTNA) solution instead, disable the SSL-VPN service entirely. You cannot exploit a service that isn’t running.
6. Layer zero-trust controls at your perimeter. Even with the latest FortiOS firmware, assume that perimeter firewalls can be compromised. Implement micro-segmentation, strong MFA, and device health attestation so that a compromised perimeter appliance cannot be used as a pivot point into your core network.
7. Monitor for anomalous HTTP requests to your FortiGate management interface, particularly any containing double-slash path patterns (//) in the URL that might indicate exploitation attempts or active scanning.

Frequently Asked Questions

What exactly is CVE-2025-68686 and why is it in CISA’s KEV catalog?

CVE-2025-68686 is a vulnerability in Fortinet FortiOS that allows a remote attacker to bypass the patch Fortinet issued to address SSL-VPN symbolic link persistence attacks. By sending HTTP requests with a doubled slash in the path (/lang//custom instead of /lang/custom), an attacker can evade Fortinet’s string-matching mitigation and access files through any symlinks that were planted during a prior compromise. CISA added it to the KEV catalog on July 27, 2026, because active exploitation has been confirmed in the wild.

If I already patched my FortiGate for CVE-2024-21762, am I still vulnerable?

Possibly. If your device was compromised before you patched CVE-2024-21762 (or CVE-2022-42475 or CVE-2023-27997) and an attacker planted symlinks during that window, those symlinks may still exist even after your firmware upgrade. CVE-2025-68686 gives an attacker a new way to exploit those old artefacts. You must both upgrade to a fixed FortiOS version AND forensically scan for and remove any residual symlinks.

Which FortiOS versions fix CVE-2025-68686?

FortiOS 7.6.2 and later, and FortiOS 7.4.7 and later, contain the fix. For FortiOS branches 7.2, 7.0, and 6.4, upgrade to the latest available patched release or, if those branches are end-of-support, migrate to a supported version. Check Fortinet’s advisory FG-IR-25-934 for the authoritative version matrix.

Does this vulnerability require valid credentials to exploit?

No — the bypass itself is unauthenticated. An attacker only needs network access to the FortiGate’s HTTPS interface to send the crafted request. However, to actually read sensitive files, there must be a pre-existing symlink pointing from the SSL-VPN directory into a sensitive part of the root filesystem. That symlink would have been planted during a prior compromise using one of the earlier CVEs.

---

The bottom line is this: Fortinet perimeter devices are among the most targeted assets on the internet, and CVE-2025-68686 demonstrates that closing one door does not mean the building is secure. Attackers are methodical. They plant persistence mechanisms knowing that organisations will patch the initial entry point — and then they wait for a bypass opportunity. Defending against this requires more than firmware hygiene; it requires ongoing forensic awareness of what is living on your appliances and a zero-trust mindset that treats every perimeter device as potentially hostile.

If you are not certain whether your FortiGate estate was ever compromised between 2022 and 2024, or if you need expert eyes on your perimeter security architecture, contact Sanjay Seth’s team for a security assessment. With deep specialisation in FortiGate, zero-trust architecture, and NOC/SOC operations across the India market, we can help you determine your true exposure and build a remediation plan that closes not just the front door, but every hidden window attackers may have left behind.