[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2025-68686":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-22T20:44:10.849Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":1074,"aliases":1075,"duplicate_of":9,"upstream":1076,"downstream":1077,"duplicates":1078,"related":1079,"reserved_at":9,"published_at":1080,"modified_at":1081,"state":1082,"summary":1083,"references_raw":1094,"kevs":1107,"epss":1118,"epss_history":1121,"metrics":1398,"affected":1408},"CVE-2025-68686","An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-200","Exposure of Sensitive Information to an Unauthorized Actor","The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.","weakness","Draft","Class","High",[20,24,208,234,238,242,246,250,254,258,348,352,356,378,382,386,390,394,404,408,412,416,420,424,428,432,436,500,504,530,552,556,560,564,568,572,576,580,584,588,592,596,600,604,608,612,644,648,670,692,738,764,864,868,993,1030,1040,1050,1070],{"id":21,"name":22,"techniques":23},"CAPEC-116","Excavation",[],{"id":25,"name":26,"techniques":27},"CAPEC-13","Subverting Environment Variable Values",[28,126,168],{"id":29,"name":30,"tactics":31,"countermeasures":38},"T1562.003","Impair Command History Logging",[32,35],{"id":33,"name":34},"TA0030","Defense Evasion",{"id":36,"name":37},"TA0005","Stealth",[39,44,49,54,58,62,67,71,76,81,85,89,93,97,101,105,109,113,118,122],{"id":40,"name":41,"tactic":42},"D3-EFA","Emulated File Analysis",{"name":43},"Detect",{"id":45,"name":46,"tactic":47},"D3-DF","Decoy File",{"name":48},"Deceive",{"id":50,"name":51,"tactic":52},"D3-CM","Content Modification",{"name":53},"Isolate",{"id":55,"name":56,"tactic":57},"D3-EAL","Executable Allowlisting",{"name":53},{"id":59,"name":60,"tactic":61},"D3-CF","Content Filtering",{"name":53},{"id":63,"name":64,"tactic":65},"D3-RKD","Registry Key Deletion",{"name":66},"Evict",{"id":68,"name":69,"tactic":70},"D3-EDL","Executable Denylisting",{"name":53},{"id":72,"name":73,"tactic":74},"D3-FE","File Encryption",{"name":75},"Harden",{"id":77,"name":78,"tactic":79},"D3-CI","Configuration Inventory",{"name":80},"Model",{"id":82,"name":83,"tactic":84},"D3-DRA","Disable Remote Access",{"name":75},{"id":86,"name":87,"tactic":88},"D3-CQ","Content Quarantine",{"name":53},{"id":90,"name":91,"tactic":92},"D3-RFAM","Remote File Access Mediation",{"name":53},{"id":94,"name":95,"tactic":96},"D3-FA","File Analysis",{"name":43},{"id":98,"name":99,"tactic":100},"D3-FIM","File Integrity Monitoring",{"name":43},{"id":102,"name":103,"tactic":104},"D3-LFP","Local File Permissions",{"name":53},{"id":106,"name":107,"tactic":108},"D3-ACH","Application Configuration Hardening",{"name":75},{"id":110,"name":111,"tactic":112},"D3-DA","Dynamic Analysis",{"name":43},{"id":114,"name":115,"tactic":116},"D3-RC","Restore Configuration",{"name":117},"Restore",{"id":119,"name":120,"tactic":121},"D3-FEV","File Eviction",{"name":66},{"id":123,"name":124,"tactic":125},"D3-RF","Restore File",{"name":117},{"id":127,"name":128,"tactics":129,"countermeasures":141},"T1574.006","Dynamic Linker Hijacking",[130,133,136,137,138],{"id":131,"name":132},"TA0110","Persistence",{"id":134,"name":135},"TA0111","Privilege Escalation",{"id":33,"name":34},{"id":36,"name":37},{"id":139,"name":140},"TA0104","Execution",[142,144,146,148,150,152,154,158,160,162,164,166],{"id":98,"name":99,"tactic":143},{"name":43},{"id":50,"name":51,"tactic":145},{"name":53},{"id":72,"name":73,"tactic":147},{"name":75},{"id":119,"name":120,"tactic":149},{"name":66},{"id":45,"name":46,"tactic":151},{"name":48},{"id":123,"name":124,"tactic":153},{"name":117},{"id":155,"name":156,"tactic":157},"D3-SFA","System File Analysis",{"name":43},{"id":59,"name":60,"tactic":159},{"name":53},{"id":102,"name":103,"tactic":161},{"name":53},{"id":90,"name":91,"tactic":163},{"name":53},{"id":94,"name":95,"tactic":165},{"name":43},{"id":86,"name":87,"tactic":167},{"name":53},{"id":169,"name":170,"tactics":171,"countermeasures":177},"T1574.007","Path Interception by PATH Environment Variable",[172,173,174,175,176],{"id":131,"name":132},{"id":134,"name":135},{"id":33,"name":34},{"id":36,"name":37},{"id":139,"name":140},[178,180,182,184,186,188,190,192,194,196,198,200,202,204,206],{"id":40,"name":41,"tactic":179},{"name":43},{"id":45,"name":46,"tactic":181},{"name":48},{"id":123,"name":124,"tactic":183},{"name":117},{"id":72,"name":73,"tactic":185},{"name":75},{"id":94,"name":95,"tactic":187},{"name":43},{"id":110,"name":111,"tactic":189},{"name":43},{"id":59,"name":60,"tactic":191},{"name":53},{"id":102,"name":103,"tactic":193},{"name":53},{"id":98,"name":99,"tactic":195},{"name":43},{"id":90,"name":91,"tactic":197},{"name":53},{"id":86,"name":87,"tactic":199},{"name":53},{"id":50,"name":51,"tactic":201},{"name":53},{"id":55,"name":56,"tactic":203},{"name":53},{"id":68,"name":69,"tactic":205},{"name":53},{"id":119,"name":120,"tactic":207},{"name":66},{"id":209,"name":210,"techniques":211},"CAPEC-169","Footprinting",[212,220,228],{"id":213,"name":214,"tactics":215,"countermeasures":219},"T1217","Browser Information Discovery",[216],{"id":217,"name":218},"TA0102","Discovery",[],{"id":221,"name":222,"tactics":223,"countermeasures":227},"T1592","Gather Victim Host Information",[224],{"id":225,"name":226},"TA0043","Reconnaissance",[],{"id":229,"name":230,"tactics":231,"countermeasures":233},"T1595","Active Scanning",[232],{"id":225,"name":226},[],{"id":235,"name":236,"techniques":237},"CAPEC-22","Exploiting Trust in Client",[],{"id":239,"name":240,"techniques":241},"CAPEC-224","Fingerprinting",[],{"id":243,"name":244,"techniques":245},"CAPEC-285","ICMP Echo Request Ping",[],{"id":247,"name":248,"techniques":249},"CAPEC-287","TCP SYN Scan",[],{"id":251,"name":252,"techniques":253},"CAPEC-290","Enumerate Mail Exchange (MX) Records",[],{"id":255,"name":256,"techniques":257},"CAPEC-291","DNS Zone Transfers",[],{"id":259,"name":260,"techniques":261},"CAPEC-292","Host Discovery",[262],{"id":263,"name":264,"tactics":265,"countermeasures":267},"T1018","Remote System Discovery",[266],{"id":217,"name":218},[268,270,274,278,282,286,288,292,296,298,300,302,306,308,310,314,316,318,320,324,326,328,330,334,338,340,344],{"id":45,"name":46,"tactic":269},{"name":48},{"id":271,"name":272,"tactic":273},"D3-SCF","System Call Filtering",{"name":53},{"id":275,"name":276,"tactic":277},"D3-NTCD","Network Traffic Community Deviation",{"name":43},{"id":279,"name":280,"tactic":281},"D3-RTSD","Remote Terminal Session Detection",{"name":43},{"id":283,"name":284,"tactic":285},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":43},{"id":59,"name":60,"tactic":287},{"name":53},{"id":289,"name":290,"tactic":291},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":43},{"id":293,"name":294,"tactic":295},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":43},{"id":72,"name":73,"tactic":297},{"name":75},{"id":102,"name":103,"tactic":299},{"name":53},{"id":119,"name":120,"tactic":301},{"name":66},{"id":303,"name":304,"tactic":305},"D3-SCA","System Call Analysis",{"name":43},{"id":155,"name":156,"tactic":307},{"name":43},{"id":90,"name":91,"tactic":309},{"name":53},{"id":311,"name":312,"tactic":313},"D3-NTSA","Network Traffic Signature Analysis",{"name":43},{"id":98,"name":99,"tactic":315},{"name":43},{"id":86,"name":87,"tactic":317},{"name":53},{"id":50,"name":51,"tactic":319},{"name":53},{"id":321,"name":322,"tactic":323},"D3-APCA","Application Protocol Command Analysis",{"name":43},{"id":55,"name":56,"tactic":325},{"name":53},{"id":94,"name":95,"tactic":327},{"name":43},{"id":68,"name":69,"tactic":329},{"name":53},{"id":331,"name":332,"tactic":333},"D3-PSA","Process Spawn Analysis",{"name":43},{"id":335,"name":336,"tactic":337},"D3-CSPP","Client-server Payload Profiling",{"name":43},{"id":123,"name":124,"tactic":339},{"name":117},{"id":341,"name":342,"tactic":343},"D3-HBPI","Hardware-based Process Isolation",{"name":53},{"id":345,"name":346,"tactic":347},"D3-NTF","Network Traffic Filtering",{"name":53},{"id":349,"name":350,"techniques":351},"CAPEC-293","Traceroute Route Enumeration",[],{"id":353,"name":354,"techniques":355},"CAPEC-294","ICMP Address Mask Request",[],{"id":357,"name":358,"techniques":359},"CAPEC-295","Timestamp Request",[360],{"id":361,"name":362,"tactics":363,"countermeasures":365},"T1124","System Time Discovery",[364],{"id":217,"name":218},[366,368,370,372,374,376],{"id":271,"name":272,"tactic":367},{"name":53},{"id":331,"name":332,"tactic":369},{"name":43},{"id":68,"name":69,"tactic":371},{"name":53},{"id":341,"name":342,"tactic":373},{"name":53},{"id":303,"name":304,"tactic":375},{"name":43},{"id":55,"name":56,"tactic":377},{"name":53},{"id":379,"name":380,"techniques":381},"CAPEC-296","ICMP Information Request",[],{"id":383,"name":384,"techniques":385},"CAPEC-297","TCP ACK Ping",[],{"id":387,"name":388,"techniques":389},"CAPEC-298","UDP Ping",[],{"id":391,"name":392,"techniques":393},"CAPEC-299","TCP SYN Ping",[],{"id":395,"name":396,"techniques":397},"CAPEC-300","Port Scanning",[398],{"id":399,"name":400,"tactics":401,"countermeasures":403},"T1046","Network Service Discovery",[402],{"id":217,"name":218},[],{"id":405,"name":406,"techniques":407},"CAPEC-301","TCP Connect Scan",[],{"id":409,"name":410,"techniques":411},"CAPEC-302","TCP FIN Scan",[],{"id":413,"name":414,"techniques":415},"CAPEC-303","TCP Xmas Scan",[],{"id":417,"name":418,"techniques":419},"CAPEC-304","TCP Null Scan",[],{"id":421,"name":422,"techniques":423},"CAPEC-305","TCP ACK Scan",[],{"id":425,"name":426,"techniques":427},"CAPEC-306","TCP Window Scan",[],{"id":429,"name":430,"techniques":431},"CAPEC-307","TCP RPC Scan",[],{"id":433,"name":434,"techniques":435},"CAPEC-308","UDP Scan",[],{"id":437,"name":438,"techniques":439},"CAPEC-309","Network Topology Mapping",[440,484,494],{"id":441,"name":442,"tactics":443,"countermeasures":445},"T1016","System Network Configuration Discovery",[444],{"id":217,"name":218},[446,448,450,452,454,456,458,460,462,464,466,468,470,472,474,476,478,480,482],{"id":303,"name":304,"tactic":447},{"name":43},{"id":68,"name":69,"tactic":449},{"name":53},{"id":50,"name":51,"tactic":451},{"name":53},{"id":271,"name":272,"tactic":453},{"name":53},{"id":72,"name":73,"tactic":455},{"name":75},{"id":119,"name":120,"tactic":457},{"name":66},{"id":90,"name":91,"tactic":459},{"name":53},{"id":59,"name":60,"tactic":461},{"name":53},{"id":55,"name":56,"tactic":463},{"name":53},{"id":45,"name":46,"tactic":465},{"name":48},{"id":98,"name":99,"tactic":467},{"name":43},{"id":40,"name":41,"tactic":469},{"name":43},{"id":331,"name":332,"tactic":471},{"name":43},{"id":110,"name":111,"tactic":473},{"name":43},{"id":341,"name":342,"tactic":475},{"name":53},{"id":94,"name":95,"tactic":477},{"name":43},{"id":86,"name":87,"tactic":479},{"name":53},{"id":102,"name":103,"tactic":481},{"name":53},{"id":123,"name":124,"tactic":483},{"name":117},{"id":485,"name":486,"tactics":487,"countermeasures":489},"T1049","System Network Connections Discovery",[488],{"id":217,"name":218},[490,492],{"id":303,"name":304,"tactic":491},{"name":43},{"id":271,"name":272,"tactic":493},{"name":53},{"id":495,"name":496,"tactics":497,"countermeasures":499},"T1590","Gather Victim Network Information",[498],{"id":225,"name":226},[],{"id":501,"name":502,"techniques":503},"CAPEC-310","Scanning for Vulnerable Software",[],{"id":505,"name":506,"techniques":507},"CAPEC-312","Active OS Fingerprinting",[508],{"id":509,"name":510,"tactics":511,"countermeasures":513},"T1082","System Information Discovery",[512],{"id":217,"name":218},[514,516,520,522,524,526,528],{"id":341,"name":342,"tactic":515},{"name":53},{"id":517,"name":518,"tactic":519},"D3-DE","Decoy Environment",{"name":48},{"id":55,"name":56,"tactic":521},{"name":53},{"id":303,"name":304,"tactic":523},{"name":43},{"id":271,"name":272,"tactic":525},{"name":53},{"id":68,"name":69,"tactic":527},{"name":53},{"id":331,"name":332,"tactic":529},{"name":43},{"id":531,"name":532,"techniques":533},"CAPEC-313","Passive OS Fingerprinting",[534],{"id":509,"name":510,"tactics":535,"countermeasures":537},[536],{"id":217,"name":218},[538,540,542,544,546,548,550],{"id":341,"name":342,"tactic":539},{"name":53},{"id":517,"name":518,"tactic":541},{"name":48},{"id":55,"name":56,"tactic":543},{"name":53},{"id":303,"name":304,"tactic":545},{"name":43},{"id":271,"name":272,"tactic":547},{"name":53},{"id":68,"name":69,"tactic":549},{"name":53},{"id":331,"name":332,"tactic":551},{"name":43},{"id":553,"name":554,"techniques":555},"CAPEC-317","IP ID Sequencing Probe",[],{"id":557,"name":558,"techniques":559},"CAPEC-318","IP 'ID' Echoed Byte-Order Probe",[],{"id":561,"name":562,"techniques":563},"CAPEC-319","IP (DF) 'Don't Fragment Bit' Echoing Probe",[],{"id":565,"name":566,"techniques":567},"CAPEC-320","TCP Timestamp Probe",[],{"id":569,"name":570,"techniques":571},"CAPEC-321","TCP Sequence Number Probe",[],{"id":573,"name":574,"techniques":575},"CAPEC-322","TCP (ISN) Greatest Common Divisor Probe",[],{"id":577,"name":578,"techniques":579},"CAPEC-323","TCP (ISN) Counter Rate Probe",[],{"id":581,"name":582,"techniques":583},"CAPEC-324","TCP (ISN) Sequence Predictability Probe",[],{"id":585,"name":586,"techniques":587},"CAPEC-325","TCP Congestion Control Flag (ECN) Probe",[],{"id":589,"name":590,"techniques":591},"CAPEC-326","TCP Initial Window Size Probe",[],{"id":593,"name":594,"techniques":595},"CAPEC-327","TCP Options Probe",[],{"id":597,"name":598,"techniques":599},"CAPEC-328","TCP 'RST' Flag Checksum Probe",[],{"id":601,"name":602,"techniques":603},"CAPEC-329","ICMP Error Message Quoting Probe",[],{"id":605,"name":606,"techniques":607},"CAPEC-330","ICMP Error Message Echoing Integrity Probe",[],{"id":609,"name":610,"techniques":611},"CAPEC-472","Browser Fingerprinting",[],{"id":613,"name":614,"techniques":615},"CAPEC-497","File Discovery",[616],{"id":617,"name":618,"tactics":619,"countermeasures":621},"T1083","File and Directory Discovery",[620],{"id":217,"name":218},[622,624,626,628,630,632,634,636,638,640,642],{"id":119,"name":120,"tactic":623},{"name":66},{"id":90,"name":91,"tactic":625},{"name":53},{"id":86,"name":87,"tactic":627},{"name":53},{"id":102,"name":103,"tactic":629},{"name":53},{"id":50,"name":51,"tactic":631},{"name":53},{"id":72,"name":73,"tactic":633},{"name":75},{"id":45,"name":46,"tactic":635},{"name":48},{"id":59,"name":60,"tactic":637},{"name":53},{"id":98,"name":99,"tactic":639},{"name":43},{"id":123,"name":124,"tactic":641},{"name":117},{"id":94,"name":95,"tactic":643},{"name":43},{"id":645,"name":646,"techniques":647},"CAPEC-508","Shoulder Surfing",[],{"id":649,"name":650,"techniques":651},"CAPEC-573","Process Footprinting",[652],{"id":653,"name":654,"tactics":655,"countermeasures":657},"T1057","Process Discovery",[656],{"id":217,"name":218},[658,660,662,664,666,668],{"id":55,"name":56,"tactic":659},{"name":53},{"id":303,"name":304,"tactic":661},{"name":43},{"id":68,"name":69,"tactic":663},{"name":53},{"id":271,"name":272,"tactic":665},{"name":53},{"id":341,"name":342,"tactic":667},{"name":53},{"id":331,"name":332,"tactic":669},{"name":43},{"id":671,"name":672,"techniques":673},"CAPEC-574","Services Footprinting",[674],{"id":675,"name":676,"tactics":677,"countermeasures":679},"T1007","System Service Discovery",[678],{"id":217,"name":218},[680,682,684,686,688,690],{"id":303,"name":304,"tactic":681},{"name":43},{"id":331,"name":332,"tactic":683},{"name":43},{"id":68,"name":69,"tactic":685},{"name":53},{"id":341,"name":342,"tactic":687},{"name":53},{"id":271,"name":272,"tactic":689},{"name":53},{"id":55,"name":56,"tactic":691},{"name":53},{"id":693,"name":694,"techniques":695},"CAPEC-575","Account Footprinting",[696],{"id":697,"name":698,"tactics":699,"countermeasures":701},"T1087","Account Discovery",[700],{"id":217,"name":218},[702,706,710,714,718,722,726,730,734],{"id":703,"name":704,"tactic":705},"D3-ULA","Unlock Account",{"name":117},{"id":707,"name":708,"tactic":709},"D3-RUAA","Restore User Account Access",{"name":117},{"id":711,"name":712,"tactic":713},"D3-AL","Account Locking",{"name":66},{"id":715,"name":716,"tactic":717},"D3-CDP","Change Default Password",{"name":75},{"id":719,"name":720,"tactic":721},"D3-UAP","User Account Permissions",{"name":53},{"id":723,"name":724,"tactic":725},"D3-AM","Access Modeling",{"name":80},{"id":727,"name":728,"tactic":729},"D3-AA","Agent Authentication",{"name":75},{"id":731,"name":732,"tactic":733},"D3-LAM","Local Account Monitoring",{"name":43},{"id":735,"name":736,"tactic":737},"D3-DAM","Domain Account Monitoring",{"name":43},{"id":739,"name":740,"techniques":741},"CAPEC-576","Group Permission Footprinting",[742,748],{"id":743,"name":744,"tactics":745,"countermeasures":747},"T1069","Permission Groups Discovery",[746],{"id":217,"name":218},[],{"id":749,"name":750,"tactics":751,"countermeasures":753},"T1615","Group Policy Discovery",[752],{"id":217,"name":218},[754,756,758,762],{"id":77,"name":78,"tactic":755},{"name":80},{"id":723,"name":724,"tactic":757},{"name":80},{"id":759,"name":760,"tactic":761},"D3-NTPM","Network Traffic Policy Mapping",{"name":80},{"id":114,"name":115,"tactic":763},{"name":117},{"id":765,"name":766,"techniques":767},"CAPEC-577","Owner Footprinting",[768],{"id":769,"name":770,"tactics":771,"countermeasures":773},"T1033","System Owner/User Discovery",[772],{"id":217,"name":218},[774,776,778,780,784,786,788,792,796,800,802,806,808,812,814,816,818,820,822,824,826,828,832,834,836,840,844,848,852,856,860],{"id":123,"name":124,"tactic":775},{"name":117},{"id":271,"name":272,"tactic":777},{"name":53},{"id":94,"name":95,"tactic":779},{"name":43},{"id":781,"name":782,"tactic":783},"D3-ABPI","Application-based Process Isolation",{"name":53},{"id":98,"name":99,"tactic":785},{"name":43},{"id":55,"name":56,"tactic":787},{"name":53},{"id":789,"name":790,"tactic":791},"D3-WSAM","Web Session Access Mediation",{"name":53},{"id":793,"name":794,"tactic":795},"D3-SAOR","Segment Address Offset Randomization",{"name":75},{"id":797,"name":798,"tactic":799},"D3-PLA","Process Lineage Analysis",{"name":43},{"id":59,"name":60,"tactic":801},{"name":53},{"id":803,"name":804,"tactic":805},"D3-PSMD","Process Self-Modification Detection",{"name":43},{"id":331,"name":332,"tactic":807},{"name":43},{"id":809,"name":810,"tactic":811},"D3-RD","Restore Database",{"name":117},{"id":102,"name":103,"tactic":813},{"name":53},{"id":303,"name":304,"tactic":815},{"name":43},{"id":90,"name":91,"tactic":817},{"name":53},{"id":341,"name":342,"tactic":819},{"name":53},{"id":86,"name":87,"tactic":821},{"name":53},{"id":45,"name":46,"tactic":823},{"name":48},{"id":68,"name":69,"tactic":825},{"name":53},{"id":72,"name":73,"tactic":827},{"name":75},{"id":829,"name":830,"tactic":831},"D3-DTP","Domain Trust Policy",{"name":53},{"id":50,"name":51,"tactic":833},{"name":53},{"id":119,"name":120,"tactic":835},{"name":66},{"id":837,"name":838,"tactic":839},"D3-PSEP","Process Segment Execution Prevention",{"name":75},{"id":841,"name":842,"tactic":843},"D3-DI","Data Inventory",{"name":80},{"id":845,"name":846,"tactic":847},"D3-KBPI","Kernel-based Process Isolation",{"name":53},{"id":849,"name":850,"tactic":851},"D3-PT","Process Termination",{"name":66},{"id":853,"name":854,"tactic":855},"D3-PS","Process Suspension",{"name":66},{"id":857,"name":858,"tactic":859},"D3-HR","Host Reboot",{"name":66},{"id":861,"name":862,"tactic":863},"D3-HS","Host Shutdown",{"name":66},{"id":865,"name":866,"techniques":867},"CAPEC-59","Session Credential Falsification through Prediction",[],{"id":869,"name":870,"techniques":871},"CAPEC-60","Reusing Session IDs (aka Session Replay)",[872,924],{"id":873,"name":874,"tactics":875,"countermeasures":879},"T1134.001","Token Impersonation/Theft",[876,877,878],{"id":33,"name":34},{"id":36,"name":37},{"id":134,"name":135},[880,884,888,892,896,900,904,908,912,916,920],{"id":881,"name":882,"tactic":883},"D3-MFA","Multi-factor Authentication",{"name":75},{"id":885,"name":886,"tactic":887},"D3-DUC","Decoy User Credential",{"name":48},{"id":889,"name":890,"tactic":891},"D3-RIC","Reissue Credential",{"name":117},{"id":893,"name":894,"tactic":895},"D3-CTS","Credential Transmission Scoping",{"name":53},{"id":897,"name":898,"tactic":899},"D3-TB","Token Binding",{"name":75},{"id":901,"name":902,"tactic":903},"D3-CR","Credential Revocation",{"name":66},{"id":905,"name":906,"tactic":907},"D3-ANCI","Authentication Cache Invalidation",{"name":66},{"id":909,"name":910,"tactic":911},"D3-CH","Credential Hardening",{"name":75},{"id":913,"name":914,"tactic":915},"D3-TBA","Token-based Authentication",{"name":75},{"id":917,"name":918,"tactic":919},"D3-CRO","Credential Rotation",{"name":75},{"id":921,"name":922,"tactic":923},"D3-CCSA","Credential Compromise Scope Analysis",{"name":43},{"id":925,"name":926,"tactics":927,"countermeasures":932},"T1550.004","Web Session Cookie",[928,929],{"id":33,"name":34},{"id":930,"name":931},"TA0109","Lateral Movement",[933,935,937,939,941,943,945,947,949,951,953,955,957,959,961,963,965,967,969,971,973,975,977,979,981,983,985,987,989,991],{"id":341,"name":342,"tactic":934},{"name":53},{"id":797,"name":798,"tactic":936},{"name":43},{"id":901,"name":902,"tactic":938},{"name":66},{"id":335,"name":336,"tactic":940},{"name":43},{"id":857,"name":858,"tactic":942},{"name":66},{"id":311,"name":312,"tactic":944},{"name":43},{"id":293,"name":294,"tactic":946},{"name":43},{"id":321,"name":322,"tactic":948},{"name":43},{"id":921,"name":922,"tactic":950},{"name":43},{"id":275,"name":276,"tactic":952},{"name":43},{"id":917,"name":918,"tactic":954},{"name":75},{"id":853,"name":854,"tactic":956},{"name":66},{"id":845,"name":846,"tactic":958},{"name":53},{"id":271,"name":272,"tactic":960},{"name":53},{"id":849,"name":850,"tactic":962},{"name":66},{"id":861,"name":862,"tactic":964},{"name":66},{"id":289,"name":290,"tactic":966},{"name":43},{"id":803,"name":804,"tactic":968},{"name":43},{"id":885,"name":886,"tactic":970},{"name":48},{"id":789,"name":790,"tactic":972},{"name":53},{"id":283,"name":284,"tactic":974},{"name":43},{"id":909,"name":910,"tactic":976},{"name":75},{"id":781,"name":782,"tactic":978},{"name":53},{"id":889,"name":890,"tactic":980},{"name":117},{"id":279,"name":280,"tactic":982},{"name":43},{"id":893,"name":894,"tactic":984},{"name":53},{"id":905,"name":906,"tactic":986},{"name":66},{"id":881,"name":882,"tactic":988},{"name":75},{"id":331,"name":332,"tactic":990},{"name":43},{"id":345,"name":346,"tactic":992},{"name":53},{"id":994,"name":995,"techniques":996},"CAPEC-616","Establish Rogue Location",[997],{"id":998,"name":999,"tactics":1000,"countermeasures":1003},"T1036.005","Match Legitimate Resource Name or Location",[1001,1002],{"id":33,"name":34},{"id":36,"name":37},[1004,1006,1008,1010,1012,1014,1016,1018,1020,1022,1024,1026,1028],{"id":303,"name":304,"tactic":1005},{"name":43},{"id":94,"name":95,"tactic":1007},{"name":43},{"id":59,"name":60,"tactic":1009},{"name":53},{"id":90,"name":91,"tactic":1011},{"name":53},{"id":123,"name":124,"tactic":1013},{"name":117},{"id":271,"name":272,"tactic":1015},{"name":53},{"id":86,"name":87,"tactic":1017},{"name":53},{"id":72,"name":73,"tactic":1019},{"name":75},{"id":102,"name":103,"tactic":1021},{"name":53},{"id":98,"name":99,"tactic":1023},{"name":43},{"id":50,"name":51,"tactic":1025},{"name":53},{"id":119,"name":120,"tactic":1027},{"name":66},{"id":45,"name":46,"tactic":1029},{"name":48},{"id":1031,"name":1032,"techniques":1033},"CAPEC-643","Identify Shared Files/Directories on System",[1034],{"id":1035,"name":1036,"tactics":1037,"countermeasures":1039},"T1135","Network Share Discovery",[1038],{"id":217,"name":218},[],{"id":1041,"name":1042,"techniques":1043},"CAPEC-646","Peripheral Footprinting",[1044],{"id":1045,"name":1046,"tactics":1047,"countermeasures":1049},"T1120","Peripheral Device Discovery",[1048],{"id":217,"name":218},[],{"id":1051,"name":1052,"techniques":1053},"CAPEC-651","Eavesdropping",[1054],{"id":1055,"name":1056,"tactics":1057,"countermeasures":1061},"T1111","Multi-Factor Authentication Interception",[1058],{"id":1059,"name":1060},"TA0031","Credential Access",[1062,1066],{"id":1063,"name":1064,"tactic":1065},"D3-HCI","Hardware Component Inventory",{"name":80},{"id":1067,"name":1068,"tactic":1069},"D3-RH","Radiation Hardening",{"name":75},{"id":1071,"name":1072,"techniques":1073},"CAPEC-79","Using Slashes in Alternate Encoding",[],[],[],[],[],[],[],"2026-02-10T15:39:12.777Z","2026-07-28T03:55:36.619Z","Analyzed",{"cisa_kev":1084,"cisa_ransomware":1085,"cisa_vendor":1086,"epss_severity":1087,"epss_score":1088,"severity":1089,"severity_score":1090,"severity_version":1091,"severity_source":1092,"severity_vector":1093,"severity_status":1082},true,false,"Fortinet","low",0.01264,"medium",5.9,"v3.1","nvd","CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",[1095,1101],{"url":1096,"sources":1097,"tags":1099},"https://fortiguard.fortinet.com/psirt/FG-IR-25-934",[1098,1092],"cve.org",[1100],"Vendor Advisory",{"url":1102,"sources":1103,"tags":1104},"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686",[1098,1092],[1105,1106],"Government Resource","US Government Resource",[1108],{"source":1109,"vendor":1086,"product":1110,"date_added":1111,"vulnerability_name":1112,"short_description":1113,"required_action":1114,"due_date":1115,"known_ransomware_campaign_use":1116,"notes":1117,"exploitation_type":9},"cisa","FortiOS","2026-07-27","Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability","Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","2026-08-10","Unknown","https://fortiguard.fortinet.com/psirt/FG-IR-25-934 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-68686",{"date":1119,"score":1088,"percentile":1120},"2026-08-22",0.6746,[1122,1126,1129,1133,1136,1139,1143,1146,1149,1152,1155,1158,1161,1164,1167,1170,1173,1176,1179,1182,1185,1188,1191,1194,1197,1200,1203,1206,1209,1212,1215,1218,1222,1225,1228,1231,1234,1237,1240,1243,1246,1249,1252,1255,1258,1261,1264,1267,1270,1273,1276,1280,1283,1286,1289,1292,1295,1298,1301,1304,1307,1310,1313,1316,1319,1322,1325,1328,1332,1335,1338,1341,1344,1347,1350,1353,1356,1359,1362,1365,1368,1371,1374,1377,1380,1383,1386,1389,1392,1395],{"date":1123,"score":1124,"percentile":1125},"2026-02-11",0.0003,0.08253,{"date":1127,"score":1124,"percentile":1128},"2026-02-12",0.0828,{"date":1130,"score":1131,"percentile":1132},"2026-02-13",0.00022,0.05347,{"date":1134,"score":1131,"percentile":1135},"2026-02-14",0.0536,{"date":1137,"score":1131,"percentile":1138},"2026-02-15",0.05372,{"date":1140,"score":1141,"percentile":1142},"2026-02-16",0.00029,0.07887,{"date":1144,"score":1141,"percentile":1145},"2026-02-17",0.07853,{"date":1147,"score":1141,"percentile":1148},"2026-02-18",0.082,{"date":1150,"score":1141,"percentile":1151},"2026-02-19",0.08274,{"date":1153,"score":1141,"percentile":1154},"2026-02-20",0.08265,{"date":1156,"score":1141,"percentile":1157},"2026-02-21",0.08297,{"date":1159,"score":1141,"percentile":1160},"2026-02-22",0.08307,{"date":1162,"score":1141,"percentile":1163},"2026-02-23",0.08294,{"date":1165,"score":1141,"percentile":1166},"2026-02-24",0.08192,{"date":1168,"score":1141,"percentile":1169},"2026-02-25",0.08096,{"date":1171,"score":1141,"percentile":1172},"2026-02-26",0.08048,{"date":1174,"score":1141,"percentile":1175},"2026-02-27",0.08057,{"date":1177,"score":1141,"percentile":1178},"2026-02-28",0.08065,{"date":1180,"score":1141,"percentile":1181},"2026-03-01",0.08109,{"date":1183,"score":1141,"percentile":1184},"2026-03-02",0.08079,{"date":1186,"score":1141,"percentile":1187},"2026-03-03",0.08076,{"date":1189,"score":1141,"percentile":1190},"2026-03-04",0.0803,{"date":1192,"score":1141,"percentile":1193},"2026-03-05",0.08067,{"date":1195,"score":1141,"percentile":1196},"2026-03-06",0.08068,{"date":1198,"score":1141,"percentile":1199},"2026-03-07",0.08072,{"date":1201,"score":1141,"percentile":1202},"2026-03-08",0.08051,{"date":1204,"score":1141,"percentile":1205},"2026-03-09",0.08019,{"date":1207,"score":1141,"percentile":1208},"2026-03-10",0.07981,{"date":1210,"score":1141,"percentile":1211},"2026-03-11",0.07997,{"date":1213,"score":1141,"percentile":1214},"2026-03-12",0.08018,{"date":1216,"score":1141,"percentile":1217},"2026-03-13",0.08047,{"date":1219,"score":1220,"percentile":1221},"2026-03-14",0.00034,0.09514,{"date":1223,"score":1220,"percentile":1224},"2026-03-15",0.09498,{"date":1226,"score":1220,"percentile":1227},"2026-03-16",0.09468,{"date":1229,"score":1220,"percentile":1230},"2026-03-17",0.09454,{"date":1232,"score":1220,"percentile":1233},"2026-03-18",0.09446,{"date":1235,"score":1220,"percentile":1236},"2026-03-19",0.0944,{"date":1238,"score":1220,"percentile":1239},"2026-03-20",0.09499,{"date":1241,"score":1220,"percentile":1242},"2026-03-21",0.09714,{"date":1244,"score":1220,"percentile":1245},"2026-03-22",0.09703,{"date":1247,"score":1220,"percentile":1248},"2026-03-23",0.09647,{"date":1250,"score":1220,"percentile":1251},"2026-03-24",0.09631,{"date":1253,"score":1220,"percentile":1254},"2026-03-25",0.09717,{"date":1256,"score":1220,"percentile":1257},"2026-03-26",0.09812,{"date":1259,"score":1220,"percentile":1260},"2026-03-27",0.09824,{"date":1262,"score":1220,"percentile":1263},"2026-03-28",0.09841,{"date":1265,"score":1220,"percentile":1266},"2026-03-29",0.09803,{"date":1268,"score":1220,"percentile":1269},"2026-03-30",0.09777,{"date":1271,"score":1220,"percentile":1272},"2026-03-31",0.09723,{"date":1274,"score":1220,"percentile":1275},"2026-04-01",0.09706,{"date":1277,"score":1278,"percentile":1279},"2026-04-02",0.00031,0.08782,{"date":1281,"score":1278,"percentile":1282},"2026-04-03",0.08798,{"date":1284,"score":1278,"percentile":1285},"2026-04-04",0.0883,{"date":1287,"score":1278,"percentile":1288},"2026-04-05",0.08821,{"date":1290,"score":1278,"percentile":1291},"2026-04-06",0.0875,{"date":1293,"score":1278,"percentile":1294},"2026-04-07",0.08764,{"date":1296,"score":1278,"percentile":1297},"2026-04-08",0.08842,{"date":1299,"score":1278,"percentile":1300},"2026-04-09",0.08868,{"date":1302,"score":1278,"percentile":1303},"2026-04-10",0.08874,{"date":1305,"score":1278,"percentile":1306},"2026-04-11",0.08867,{"date":1308,"score":1278,"percentile":1309},"2026-04-12",0.08836,{"date":1311,"score":1278,"percentile":1312},"2026-04-13",0.08822,{"date":1314,"score":1278,"percentile":1315},"2026-04-14",0.08695,{"date":1317,"score":1278,"percentile":1318},"2026-04-15",0.08713,{"date":1320,"score":1278,"percentile":1321},"2026-04-16",0.08712,{"date":1323,"score":1278,"percentile":1324},"2026-04-17",0.0869,{"date":1326,"score":1278,"percentile":1327},"2026-04-18",0.08687,{"date":1329,"score":1330,"percentile":1331},"2026-04-19",0.00032,0.09159,{"date":1333,"score":1330,"percentile":1334},"2026-04-20",0.09145,{"date":1336,"score":1330,"percentile":1337},"2026-04-21",0.09338,{"date":1339,"score":1330,"percentile":1340},"2026-04-22",0.09373,{"date":1342,"score":1330,"percentile":1343},"2026-04-23",0.09396,{"date":1345,"score":1330,"percentile":1346},"2026-04-24",0.09389,{"date":1348,"score":1330,"percentile":1349},"2026-04-25",0.09375,{"date":1351,"score":1330,"percentile":1352},"2026-04-26",0.09344,{"date":1354,"score":1330,"percentile":1355},"2026-04-27",0.09325,{"date":1357,"score":1330,"percentile":1358},"2026-04-28",0.09304,{"date":1360,"score":1330,"percentile":1361},"2026-04-29",0.09306,{"date":1363,"score":1330,"percentile":1364},"2026-04-30",0.09303,{"date":1366,"score":1330,"percentile":1367},"2026-05-01",0.09256,{"date":1369,"score":1330,"percentile":1370},"2026-05-02",0.09299,{"date":1372,"score":1330,"percentile":1373},"2026-05-03",0.09274,{"date":1375,"score":1330,"percentile":1376},"2026-05-04",0.0923,{"date":1378,"score":1330,"percentile":1379},"2026-05-05",0.09221,{"date":1381,"score":1330,"percentile":1382},"2026-05-06",0.09237,{"date":1384,"score":1330,"percentile":1385},"2026-05-07",0.09385,{"date":1387,"score":1330,"percentile":1388},"2026-05-08",0.09416,{"date":1390,"score":1330,"percentile":1391},"2026-05-09",0.09459,{"date":1393,"score":1330,"percentile":1394},"2026-05-10",0.09458,{"date":1396,"score":1330,"percentile":1397},"2026-05-11",0.09437,[1399,1406],{"source":1098,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":1400,"cvss_v4_0":9},{"baseScore":1401,"baseSeverity":1402,"vectorString":1403,"impactScore":1404,"exploitabilityScore":1405},5.3,"MEDIUM","CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",6,5.6,{"source":1092,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":1407,"cvss_v4_0":9},{"baseScore":1090,"baseSeverity":1402,"vectorString":1093,"impactScore":1404,"exploitabilityScore":1405},[1409],{"ecosystem":9,"name":1110,"vendor":1410,"product":1411,"cpe_part":1412,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":1413},"fortinet","fortios","o",[1414,1419,1423,1427,1431,1435,1440],{"version":1415,"is_range":1084,"range_type":1098,"version_start":1416,"version_start_type":1417,"version_end":1418,"version_end_type":1417,"fixed_in":9},">= 7.6.0, \u003C= 7.6.1","7.6.0","including","7.6.1",{"version":1420,"is_range":1084,"range_type":1098,"version_start":1421,"version_start_type":1417,"version_end":1422,"version_end_type":1417,"fixed_in":9},">= 7.4.0, \u003C= 7.4.6","7.4.0","7.4.6",{"version":1424,"is_range":1084,"range_type":1098,"version_start":1425,"version_start_type":1417,"version_end":1426,"version_end_type":1417,"fixed_in":9},"gte7.2.0_lte7.2.13","7.2.0","7.2.13",{"version":1428,"is_range":1084,"range_type":1098,"version_start":1429,"version_start_type":1417,"version_end":1430,"version_end_type":1417,"fixed_in":9},">= 7.0.0, \u003C= 7.0.19","7.0.0","7.0.19",{"version":1432,"is_range":1084,"range_type":1098,"version_start":1433,"version_start_type":1417,"version_end":1434,"version_end_type":1417,"fixed_in":9},"gte6.4.0_lte6.4.16","6.4.0","6.4.16",{"version":1436,"is_range":1084,"range_type":1437,"version_start":1433,"version_start_type":1417,"version_end":1438,"version_end_type":1439,"fixed_in":9},"gte6.4.0_lt7.4.7","cpe","7.4.7","excluding",{"version":1441,"is_range":1084,"range_type":1437,"version_start":1416,"version_start_type":1417,"version_end":1442,"version_end_type":1439,"fixed_in":9},"gte7.6.0_lt7.6.2","7.6.2"]