Fortinet CVE-2025-68686 Added to CISA KEV Under Active Exploitation
Fortinet has had one vulnerability, CVE-2025-68686, confirmed as actively exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog on July 27, 2026.
Key findings
- Fortinet CVE-2025-68686 has been added to CISA's KEV catalog due to confirmed active exploitation.
- The vulnerability poses an immediate threat, requiring urgent patching and mitigation efforts.
- All organizations should prioritize remediation of this actively exploited flaw to prevent compromise.
CISA has added a critical Fortinet vulnerability, identified as CVE-2025-68686, to its Known Exploited Vulnerabilities (KEV) catalog. This addition on July 27, 2026, signals that the flaw is under active exploitation by threat actors, posing an immediate and significant risk to organizations utilizing affected Fortinet products.
The inclusion of CVE-2025-68686 in the KEV catalog elevates its status to a top-priority concern for cybersecurity defenders. While specific details regarding the nature of the vulnerability or the methods of exploitation have not been publicly disclosed, its presence on the KEV list confirms that adversaries are successfully leveraging this flaw in real-world attacks.
There is no indication that CVE-2025-68686 is currently associated with ransomware campaigns. However, any actively exploited vulnerability can serve as an initial access vector for a wide range of malicious activities, including data exfiltration, system compromise, and the eventual deployment of ransomware or other destructive payloads.
Organizations are strongly advised to identify and remediate all instances of CVE-2025-68686 within their environments without delay. CISA mandates that federal civilian executive branch agencies address KEV catalog vulnerabilities by specific due dates, and this directive serves as a critical benchmark for all organizations. Prioritizing the patching and mitigation of this flaw is essential to protect against ongoing threats and prevent potential breaches.