CISA’s latest Known Exploited Vulnerabilities update is a reminder that edge-device patching is only half the job. On July 27, 2026, CISA added CVE-2025-68686, a Fortinet FortiOS SSL-VPN sensitive-information exposure issue, to the KEV catalog based on evidence of active exploitation. Fortinet’s own advisory is clear about the risk pattern: this issue is not a clean “first-step” intrusion path by itself. It becomes dangerous when an attacker has already achieved filesystem-level access through another vulnerability and can then use crafted HTTP requests to bypass protections tied to a previously observed symbolic-link persistence mechanism.

That distinction matters. For SMBs and government contractors, a KEV listing on a firewall or VPN platform should not be treated as a normal maintenance ticket. It should trigger a post-compromise review of the appliance, exposed management paths, credentials, VPN users, and downstream network trust.

What was reported

Fortinet identifies the issue as an exposure of sensitive information to an unauthorized actor in FortiOS SSL-VPN. A remote unauthenticated attacker may abuse crafted HTTP requests, but Fortinet notes the attacker would first need to have compromised the device through another vulnerability at the filesystem level. CISA added the vulnerability to KEV on July 27, 2026, with a federal remediation due date of August 10, 2026.

Affected FortiOS branches listed by Fortinet include:

  • FortiOS 7.6.0 through 7.6.1 — upgrade to 7.6.2 or later.
  • FortiOS 7.4.0 through 7.4.6 — upgrade to 7.4.7 or later.
  • FortiOS 7.2, 7.0, and 6.4 — migrate to a fixed release path.

Fortinet also states that products that never had SSL-VPN enabled are not impacted by this issue.

Why this matters

Edge appliances sit in the worst possible place for defenders: internet-facing, deeply trusted, and often under-logged compared with normal servers. When a firewall, VPN, or SD-WAN controller is abused after an earlier compromise, patching may close the current code path while leaving behind stolen credentials, hidden persistence, altered configuration, or attacker knowledge of the environment.

That is especially relevant for government contractors and small businesses that rely on managed firewalls as a primary security boundary. If the device has been exposed to the internet and SSL-VPN was enabled, leadership should assume the question is not only “are we patched?” but also “was this device already touched?”

Defensive takeaways

  • Patch or migrate immediately. Move affected 7.6 and 7.4 systems to Fortinet’s fixed versions. Treat unsupported or migration-required branches as a priority risk decision, not a backlog item.
  • Confirm SSL-VPN exposure. Identify whether SSL-VPN was enabled, when it was exposed, and whether management interfaces were reachable from untrusted networks.
  • Run post-compromise triage. Review FortiGate logs, configuration changes, unexpected local files, admin activity, new accounts, VPN authentications, and anomalous outbound connections.
  • Rotate credentials after validation. If compromise is suspected, rotate local admins, VPN user passwords, shared secrets, API keys, and any credentials that may have passed through the device.
  • Reduce appliance trust. Segment VPN users, enforce MFA, restrict admin access to dedicated management networks, and forward logs to a SIEM or managed detection provider.
  • Document KEV response evidence. Contractors supporting federal customers should retain patch records, exposure checks, triage notes, and credential-rotation evidence for audit and customer assurance.

Bulwark Black assessment

CVE-2025-68686 is a good example of why KEV-driven vulnerability management must include incident response logic. This is not just a software defect; it is a signal that attackers are chaining edge-device weaknesses and abusing the residue of prior compromise. For defenders, the practical move is to pair urgent remediation with appliance-level forensics, credential hygiene, and tighter management-plane exposure controls.

Source: Fortinet PSIRT advisory FG-IR-25-934; CISA KEV alert.