Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2025-68686.
Upgrade to ProDetect Fortinet FortiOS Sensitive Information Exposure (CVE-2025-68686) in Microsoft Sentinel
CVE-2025-68686 is an Exposure of Sensitive Information to an Unauthorized Actor vulnerability (CWE-200) in Fortinet FortiOS, added to CISA's Known Exploited Vulnerabilities catalog. Unauthorized actors may be able to access sensitive information exposed by affected FortiOS instances, potentially including configuration data, credentials, session tokens, or internal system details that could facilitate further compromise. This detection focuses on identifying anomalous access to FortiOS management interfaces, unusual API/CLI enumeration behavior, and downstream indicators of information disclosure abuse such as suspicious authentication following reconnaissance against exposed FortiOS endpoints.
MITRE ATT&CK
KQL Detection Query
// Detect anomalous access patterns to FortiOS management interfaces preceding suspected information disclosure
let lookback = 1d;
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor has "Fortinet"
| where DeviceEventClassID has_any ("admin", "webadmin", "sslvpn", "management")
| where Activity has_any ("login", "config", "get", "download", "backup")
| summarize RequestCount = count(), Activities = make_set(Activity), Users = make_set(SourceUserName) by SourceIP, DestinationIP, DeviceProduct, bin(TimeGenerated, 1h)
| where RequestCount > 20
| project TimeGenerated, SourceIP, DestinationIP, DeviceProduct, RequestCount, Activities, Users
| order by RequestCount descIdentifies unusually high volumes of administrative/management activity against FortiOS devices in a short window, consistent with enumeration or automated extraction of sensitive information exposed by CVE-2025-68686.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate bulk configuration backups by administrators
- Scheduled automated compliance/config-export jobs
- Vulnerability scanning performed by authorized security teams
- Multiple concurrent admin sessions during change windows
Other platforms for CVE-2025-68686
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate high-volume FortiOS admin API access
Expected signal: Multiple HTTP GET requests to /api/v2/cmdb/* endpoint from a single source IP within a short time window, logged in firewall/proxy logs.
- Test 2Simulate FortiOS config backup enumeration
Expected signal: Repeated backup/config-related HTTP requests logged in FortiOS event logs and network proxy logs.
- Test 3Simulate SSL-VPN portal session enumeration
Expected signal: Multiple failed/attempted SSL-VPN login events logged with consistent source IP within a short window.
References (4)
- https://fortiguard.fortinet.com/psirt/FG-IR-25-934
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2025-68686
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2025-68686 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month