OTPulse

SSL-VPN Symlink Persistence Patch Bypass

Act NowCVSS 5.3FG-IR-25-934Feb 10, 2026
Fortinet
IT in OT - Fortinet products are commonly deployed at IT/OT network boundaries
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary

A vulnerability in FortiOS SSL-VPN allows an attacker who has already compromised the device to bypass security patches and maintain persistent access through symlink exploitation. The vulnerability affects FortiOS versions 7.6.0-7.6.1, 7.4.0-7.4.6, 7.2.x, 7.0.x, and 6.4.x. While this is a post-exploit persistence technique rather than an initial attack vector, it significantly increases the risk of a compromised SSL-VPN gateway remaining compromised even after firmware patching.

What this means
What could happen
An attacker who has already compromised a FortiOS SSL-VPN gateway could use a symlink technique to bypass patches and maintain persistent access even after security updates are applied. This could allow continued unauthorized access to your network and the systems it protects.
Who's at risk
Network administrators and security teams responsible for FortiOS SSL-VPN gateways, particularly those protecting perimeter access to critical infrastructure, industrial networks, or remote access systems for OT/industrial environments.
How it could be exploited
An attacker must first gain initial access to the FortiOS device (through a separate vulnerability or credential compromise). Once inside, they can exploit a symlink mechanism to create persistent code that survives patching attempts, allowing them to maintain a backdoor that re-establishes itself even after you update the firmware.
Prerequisites
  • Initial compromise of FortiOS device (separate vulnerability or credential theft required)
  • Ability to write files to the target system during exploitation
  • FortiOS running affected version (7.6.0-7.6.1, 7.4.0-7.4.6, or 7.0-7.2.x)
Patch bypass techniquePost-exploitation persistence mechanismAffects widely-deployed SSL-VPN appliancesMultiple firmware versions vulnerableEnd-of-life versions (7.0, 7.2) require full migration
Exploitability
Actively exploited — confirmed by CISA KEV
Affected products (5)
5 with fix
ProductAffected VersionsFix Status
FortiOS7.6.0 - 7.6.17.6.2+
FortiOS7.4.0 - 7.4.67.4.7+
FortiOS7.2 all versionsMigrate to fixed release
FortiOS7.0 all versionsMigrate to fixed release
FortiOS6.4 all versionsMigrate to fixed release
Remediation & Mitigation
0/5
Do now
0/2
FortiOS
HARDENINGPerform full system audit and file integrity check on all FortiOS devices to detect any suspicious symlinks or unauthorized persistent modifications
All products
HARDENINGReview SSL-VPN access logs for anomalous admin logins or file modifications preceding the update
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

FortiOS
HOTFIXUpgrade FortiOS 7.6.x to version 7.6.2 or later
HOTFIXUpgrade FortiOS 7.4.x to version 7.4.7 or later
HOTFIXPlan migration from FortiOS 7.2 or 7.0 to a patched 7.4+ or 7.6+ release
View full vendor advisory
API: /api/v1/advisories/a0f5b408-d0fb-4b44-ad8a-4a2c9490b016

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

SSL-VPN Symlink Persistence Patch Bypass | CVSS 5.3 - OTPulse