Bottom line: An actively exploited FortiOS vulnerability bypasses an earlier protection against symlink manipulation, affected systems must be updated and checked for prior compromises.
An actively exploited security vulnerability in FortiOS allows attackers to bypass a previously introduced protection mechanism against manipulated symbolic links. Affected Fortinet systems must be updated and checked for prior compromises.
Fortinet has confirmed a vulnerability in FortiOS that can be used to bypass an earlier protection mechanism against manipulated symbolic links (symlinks). According to Security-Insider, the vulnerability is already being actively exploited. The report at hand does not provide details on a specific CVE number, affected version levels, or a CVSS score.
Symlink attacks against FortiOS systems are not a new phenomenon: in the past, attackers had already used manipulated symbolic links to maintain persistent access to compromised Fortinet appliances, even after the original attack vector had been closed by patches. Fortinet responded with a protection mechanism specifically designed to prevent this persistence technique. The vulnerability that has now come to light overrides this protection, once again giving attackers the ability to establish persistent footholds in affected systems.
For CISOs, this means one thing above all: a single applied update is not sufficient to consider systems permanently secure if earlier compromises have gone undetected. Since the vulnerability disables an existing protection mechanism, there is a risk that systems already compromised may remain under attacker control despite prior patches, without this being noticed. Organizations operating Fortinet SSL-VPN products in particular should take this as an occasion to check their systems for signs of compromise.
Affected systems should be brought up to the updated versions provided by Fortinet without delay. In addition, it is advisable to specifically examine affected devices for traces of previous compromises, such as remaining symlinks or persistence mechanisms that may have remained in the system despite prior patches. Organizations operating relevant Fortinet products should consult the vendor’s advisories and indicators of compromise and incorporate them into their own incident response planning.
Source: www.security-insider.de · Published August 7, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.