Fortinet FortiOS path traversal added to CISA KEV (CVE-2025-61624)

CISA added CVE-2025-61624, a Fortinet path traversal vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-16, meaning it is being exploited in the wild. The flaw affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, and federal agencies have until 2026-10-19 to apply mitigations, according to the CISA KEV entry.

Details of the attacks, including who is exploiting it and how often, have not been disclosed.

What happened

CISA lists the flaw as “Fortinet Multiple Products Path Traversal Vulnerability”. Per the NVD record, it is an improper limitation of a pathname to a restricted directory (CWE-22). An authenticated attacker with an admin profile and at least read-write permissions can write or delete arbitrary files by running specific CLI commands.

The vulnerability was published in NVD on 2026-04-14. Fortinet tracks it as FG-IR-26-122 in its PSIRT advisory.

Why this matters

Analysis, not new facts: the attacker needs high privileges first, so this is unlikely to be the way in. It is more useful as a second step after an attacker has already obtained admin credentials, for example by phishing, credential reuse or another bug. From there, arbitrary file write and delete on a firewall, proxy or privileged access management appliance could be used to tamper with configuration or remove evidence. Any device with an exposed or weakly protected admin interface deserves the most attention.

Because the flaw is in CISA KEV, treat it as a patch-within-hours item for internet-facing management planes, even though the base score is only medium.

Am I affected?

NVD lists these affected ranges:

• FortiOS 6.4.0 up to but not including 7.4.10, and 7.6.0 up to but not including 7.6.5
• FortiPAM 1.0.0 up to but not including 1.7.1
• FortiProxy 7.0.0 up to but not including 7.4.12, and 7.6.0 up to but not including 7.6.5
• FortiSwitchManager 7.0.0 up to but not including 7.0.7, and 7.2.0 up to but not including 7.2.8
• Siemens RUGGEDCOM APE1808 firmware

The vendor description also says FortiOS 7.2, 7.0 and 6.4 are affected in all versions, and likewise the older FortiPAM and FortiProxy 7.2 and 7.0 branches. Check the Fortinet advisory for the fixed release for your branch.

Technical details

• Weakness: CWE-22, path traversal.
• CVSS: 6.0 (medium), vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H.
• Attack vector: the vector says local, with high privileges required. The description says the attacker uses CLI commands. Whether remote exploitation over a management interface is involved in the observed attacks is not disclosed.
• Impact: high integrity and availability impact, no confidentiality impact in the score.
• EPSS: 0.0058, a low predicted probability, which sits oddly beside the confirmed exploitation. Confirmed exploitation in KEV outweighs the score.
• Ransomware use: unknown, per CISA.
• KEV dates: added 2026-10-16, due 2026-10-19.

How to fix CVE-2025-61624

CISA’s required action tells organisations to apply mitigations in line with vendor instructions and its BOD 26-04 guidance, including its forensics triage requirements. For cloud services it says to follow the BOD 26-04 guidance, or stop using the product if mitigations are not available.

What to do

1. Inventory every FortiOS, FortiPAM, FortiProxy and FortiSwitchManager device, plus any Siemens RUGGEDCOM APE1808 units, and compare versions with the ranges above.
2. Upgrade to the fixed release listed in Fortinet advisory FG-IR-26-122. Prioritise devices whose admin interface is reachable from the internet or from broad internal networks.
3. Restrict admin access to a dedicated management network or trusted hosts, and require multi-factor authentication for admin accounts.
4. Review admin accounts and their permissions. Remove read-write admin rights that are not needed, since the flaw requires them.
5. Hunt for signs of abuse: unexpected admin logins, CLI sessions at unusual times, and configuration or system files that changed or disappeared without a change ticket. Preserve logs and device state before rebooting or upgrading, in line with CISA’s forensics triage requirement.
6. If you cannot patch or mitigate by the due date, record the exception and consider taking the device out of service, as CISA advises for products without mitigations.

Sources: the CISA KEV catalog, the NVD record and the Fortinet PSIRT advisory linked above.

Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.

Related coverage

• Cisco Secure Email Gateway path traversal added to CISA KEV (CVE-2026-76519)
• ONLYOFFICE Docs path traversal CVE-2021-3199 added to CISA KEV
• Fortinet FortiMail path traversal exploited (CVE-2026-104286)

Sources

• CISA Known Exploited Vulnerabilities catalog: CVE-2025-61624
• NVD: CVE-2025-61624
• Fortinet PSIRT advisory FG-IR-26-122