Fortinet FortiOS Vulnerability CVE-2025-68686: What Small Business Owners Need to Know Right Now
Yesterday, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-68686 to its Known Exploited Vulnerabilities catalog. This Fortinet FortiOS exposure vulnerability is actively being exploited in the wild, and if your business uses FortiOS firewalls or VPNs, you need to take action immediately. The deadline for federal systems is August 10, 2026, but that doesn't mean you can wait—active exploitation means attackers are already weaponizing this flaw against private sector targets.
What This Vulnerability Actually Does
Here's what matters: attackers can bypass patches and extract sensitive information from your FortiOS devices. The vulnerability requires an attacker to have already compromised your device through a different entry point, but once inside, they can use crafted HTTP requests to slip past the security fix Fortinet deployed. That means even patched systems could be at risk if an attacker chains multiple weaknesses together.
The real danger isn't the vulnerability itself—it's the access that precedes it. If someone has already broken into your firewall through another route, this flaw becomes their toolkit for extracting credentials, configuration data, or other sensitive material. You won't see this attack coming as a standalone threat. You'll see it as part of a broader compromise you may not have detected yet.
Why Detection Matters More Than You Think
Most small business owners focus on patching, which is necessary. But here's what security teams actually worry about: whether you've already been compromised and don't know it yet. The time between when an attacker exploited your FortiOS device and when you patched it is the window where this vulnerability becomes useful to them. If your incident response plan doesn't include forensic review of your FortiOS logs and filesystem, you're leaving potential breach evidence on the table.
CISA's guidance requires forensic triage for anyone who may have been exposed. That means reviewing logs, checking for signs of unauthorized access, and validating file integrity. This isn't optional checkbox work—it's the difference between knowing you were hit and discovering a breach six months later.
Three Steps You Need to Take This Week
Step 1: Inventory Your FortiOS Deployments
Document every FortiOS device your business runs. Include firewalls, VPNs, and any other FortiOS-based security appliances. Know which ones face the internet directly and which are behind other layers. If you don't know where all your FortiOS devices are, you can't patch them, and you can't secure them.
Step 2: Apply Fortinet's Mitigations Immediately
Visit Fortinet's advisory for your specific FortiOS version and apply the recommended patches or mitigations without delay. Follow CISA's BOD 26-04 guidance, which prioritizes internet-facing devices. If your vendor can't provide mitigations for a particular device, you need to make a hard decision: patch to a supported version, replace the hardware, or take it offline. Continuing to run unmitigated systems isn't acceptable anymore.
Step 3: Conduct Forensic Review of Exposed Devices
If any FortiOS device was exposed to the internet or potentially compromised before patching, treat it as a forensic investigation. Review authentication logs for suspicious access, check for unexpected configuration changes, and examine filesystem integrity. If you don't have forensic expertise in-house, engage an incident response firm. This is where you find out whether active exploitation actually reached your business.