CISA
Fortinet FortiOS bug CVE-2025-68686 exposes data to hackers
The Known Exploited Vulnerabilities (KEV) Catalog is maintained by CISA to assist organizations in managing vulnerabilities that are actively exploited in real-world attacks. It serves as a critical resource for cybersecurity professionals to prioritize their vulnerability management efforts. The current entry details the Fortinet FortiOS vulnerability (CVE-2025-68686) that exposes sensitive information to unauthorized actors, potentially allowing further attacks if the system was previously compromised. Recommendations include following vendor guidance for mitigations and adhering to CISA's directives for security updates.
How the story developed
All 5 articles5 articles from 4 outlets over 168 days. This was the 4th report, 167 days after the first.
5 articles from 4 outlets since 11 Feb; the latest 90 days ago.
- Article
- First report
- Official notice
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 28 Jul · 09:01 UTC | Security Affairs | U.S. CISA adds Arista VeloCloud Orchestrator and Fortinet FortiOS flaws to its Known Exploited Vulnerabilities catalog |
| Tue 28 Jul · 08:46 UTC | CISA | Fortinet FortiOS bug CVE-2025-68686 exposes data to hackers |
| Mon 27 Jul · 22:51 UTC | CISA | CISA adds FortiOS info leak CVE-2025-68686 to KEV, urges patch |
| Mon 27 Jul · 22:32 UTC | SecurityOnline | CISA adds Arista VeloCloud RCE and Fortinet FortiOS bypass to KEV |
| Wed 11 Feb · 10:05 UTC | SecurityWeek | Fortinet Patches High-Severity Vulnerabilities |
Who reported 4 outlets
- CISA2
- SecurityWeek1
- SecurityOnline1
- Security Affairs1
- Fortinet Patches High-Severity VulnerabilitiesSecurityWeek · first report
- Fortinet FortiOS bug CVE-2025-68686 exposes data to hackersCISA · this article · 4 of 5