Fortinet security advisory (AV26-109) – Update 1
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Serial number: AV26-109 Date: February 10, 2026 Updated: July 27, 2026 On February 10, 2026, Fortinet published security advisories to address vulnerabilities in the following products: FortiAuthenticator 6.6 – versions 6.6.0 to 6.6.6 FortiAuthenticator 6.5 – all versions FortiAuthenticator 6.4 – all versions FortiAuthenticator 6.3 – all versions FortiClientWindows 7.4 – versions 7.4.0 to 7.4.4 FortiClientWindows 7.2 – versions 7.2.0 to 7.2.12 FortiClientWindows 7.0 – all versions FortiOS 7.6 – versions 7.6.0 to 7.6.4 FortiOS 7.4 – versions 7.4.0 to 7.4.10 FortiOS 7.2 – all versions FortiOS 7.0 – all versions FortiOS 6.4 – all versions FortiSandbox 5.0 – version 5.0 to 5.1 FortiSandbox 4.4 – version 4.4.0 to 4.4.7 FortiSandbox 4.2 – all versions FortiSandbox 4.0 – all versions Update 1 On July 27, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-68686 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates. Fortinet PSIRT Advisories CISA KEV: CVE-2025-68686
CSIRTS triage
- What
- There is a vulnerability that exposes sensitive information to unauthorized actors.
- Who is affected
- Deployments of FortiOS versions 6.0 to 7.6.4, FortiAuthenticator, and FortiClient.
- Urgency
- Remediation is urgent due to active exploitation and potential severe impact.
- Action
- Update to the latest patched versions as soon as possible.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch FortiOS
Get an email when a new FortiOS advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-109
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2025-68686Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 67% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2025-68686 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[UPDATE] [high] Fortinet FortiOS: Multiple Vulnerabilitiescert-bund
- highexploitedCISA Adds Two Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerabilitycisa-kev
More from Canadian Centre for Cyber Security
- unknownGoogle security advisory (AV26-768)2026-07-31
- unknownRails security advisory (AV26-767)2026-07-31
- unknownSolarWinds security advisory (AV26-766)2026-07-31
- unknownGladinet security advisory (AV26-765)2026-07-30
- unknownPHP Group security advisory (AV26-764)2026-07-30