A logged-in administrator can use it to write or delete files anywhere on the device. CISA lists it as exploited.
What it allows
An attacker who already has an admin profile with at least read-write rights can pass crafted arguments to existing CLI commands and write or delete arbitrary files on the device. Fortinet rates the impact as escalation of privilege. The score is only Medium because the attacker needs high privileges first. CISA still lists the flaw as exploited, so any stolen or weak admin login on these devices is a real risk. Fortinet scores it 6.0 and NVD scores it 6.5, both on CVSS v3.1.
Who is affected
Per Fortinet advisory FG-IR-26-122 and NVD: FortiOS 7.6.0 to 7.6.4 (fixed in 7.6.5), FortiOS 7.4.0 to 7.4.9 (fixed in 7.4.10), and all versions of FortiOS 7.2, 7.0 and 6.4. FortiPAM 1.7.0 (fixed in 1.7.1) and all versions of FortiPAM 1.0 to 1.6. FortiProxy 7.6.0 to 7.6.4 (fixed in 7.6.5), FortiProxy 7.4.0 to 7.4.11 (fixed in 7.4.12), and all versions of FortiProxy 7.2 and 7.0. FortiSwitchManager 7.2.0 to 7.2.7 (fixed in 7.2.8) and 7.0.0 to 7.0.6 (fixed in 7.0.7). FortiPAM 1.8 is not affected. For the branches marked all versions, the advisory says to migrate to a fixed release.
For a Fortinet flaw that needs no login, see the unauthenticated SQL injection in FortiClientEMS 7.4.4. Fortinet fixed it in 7.4.5.
Timeline
- 14 Apr 2026
Fortinet publishes advisory FG-IR-26-122 and NVD publishes the CVE record. The advisory says the vendor found the flaw internally. It now also marks the flaw as known exploited.
- 15 Oct 2026
The NVD record carries a CISA SSVC entry dated this day that marks exploitation as active.
- 16 Oct 2026
CISA adds the CVE to its Known Exploited Vulnerabilities catalog and flags forensic triage as required.
- 19 Oct 2026
CISA due date for federal agencies to apply the vendor mitigations.
Who exploits it
What to do
-
Upgrade to a fixed release
Move FortiOS to 7.6.5 or 7.4.10, FortiProxy to 7.6.5 or 7.4.12, FortiPAM to 1.7.1, and FortiSwitchManager to 7.2.8 or 7.0.7. Fortinet offers an upgrade path tool for planning the move.
-
Plan a migration for old branches
FortiOS 7.2, 7.0 and 6.4, FortiProxy 7.2 and 7.0, and FortiPAM 1.0 to 1.6 have no fix inside the branch. Fortinet says to migrate to a fixed release, so put these devices on the upgrade list first.
-
Use the virtual patch if you cannot upgrade yet
Fortinet lists a virtual patch for this flaw. The advisory names it FG-VD-59270 and says it is in FMWP database update 25.120. Treat it as a stopgap, not a fix.
-
Lock down admin access
The attack needs an admin profile with read-write rights. Limit admin logins to a management network, turn on a second sign-in step for admins, and remove admin accounts nobody uses.
-
Detect and hunt
CISA marks forensic triage as required for this entry. Review admin sessions and CLI command history for unusual file operations, check for files that changed or vanished, and compare the device configuration with a known-good copy. If you suspect misuse, rotate admin passwords and stored credentials.
Frequently Asked Questions
Is CVE-2025-61624 dangerous if it only scores Medium?
CISA lists it as exploited, so the score alone should not set your priority. The attacker needs an admin profile first, which makes stolen admin logins the main risk. Fortinet's advisory, first published in April 2026, now marks the flaw as known exploited. It is one of nine flaws listed in our CISA KEV roundup for 13 to 16 October 2026.
Which Fortinet products are affected?
FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. The exact versions and fixes are in Fortinet advisory FG-IR-26-122, and the list on this page follows it.
Has anyone been named as using this flaw?
CISA, NVD and Fortinet name no group or malware, and CISA lists ransomware campaign use as unknown. Palo Alto Networks Unit 42 reported on 14 October 2026 an intrusion in which this flaw was used to reach root on FortiOS devices and install the malware PEERSTITCH. Unit 42 says the attackers first entered through a FortiManager, using CVE-2024-47575. That link comes from Unit 42 alone. See the PEERSTITCH page.
Does Fortinet have other exploited flaws on this site?
Yes. Earlier FortiOS flaws on our site include the SSL-VPN heap overflow CVE-2022-42475. Another is the SSL VPN out-of-bounds write CVE-2024-21762. A third is the authentication bypass CVE-2024-55591. Two incident pages cover Fortinet devices: Fortinet FortiCloud SSO exploitation and Fortinet device credential exposure. Those are separate events and are not linked to this flaw by the sources opened here. A path traversal flaw in another Fortinet product is CVE-2026-106173 in FortiSIEM.
