CVE-2025-68686

Think of FortiOS like the “front desk” and internal router brain of your network. This bug can let a stranger on the internet pull out confidential information and possibly interact with powerful internal functions without signing in. In real incidents, attackers have used it as a zero-day to probe and act on systems they can reach.

This matters if your business runs Fortinet FortiOS on a device that is reachable over the network (including from the internet). The vulnerability does not require authentication or user interaction, so exposure depends mainly on whether the attacker can reach the vulnerable service path.

Because “reachable in default config” is not specified in the findings, the practical gate for you is: if your FortiOS device/service is accessible from outside your network, treat it as reachable until you verify otherwise.

This is RED because it is confirmed to be in CISA KEV and exploitation has been reported in the wild. Attackers can reach the weakness remotely without logging in, which makes “internet exposure + unpatched FortiOS” a direct risk for sensitive data leaks and follow-on compromise.

Do not wait for symptoms—patching should be treated as urgent remediation for exposed assets.