Log in Request a demo

Exploited vulnerability

Fortinet CLI path traversal flaw (CVE-2025-61624)

A path traversal flaw in the command line of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager.

  • On CISA KEV
CVE ID
CVE-2025-61624
CVSS
6.0 Medium (CVSS v3.1, Fortinet); 6.5 Medium (CVSS v3.1, NVD)
CISA KEV
Listed
Affected product
FortiOS, FortiPAM, FortiProxy and FortiSwitchManager
Exploited
16 October 2026 (CISA KEV listing); the Fortinet advisory, first published 14 April 2026, now marks it as known exploited
Published
April 2026

In short

CVE-2025-61624 is a path traversal flaw in the command line of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. A logged-in administrator can use it to write or delete files anywhere on the device. CISA lists it as exploited.

Profile MapVulnerability
  1. CVECVE-2025-61624
  2. ProductFortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager
  3. CISA KEVListedKnown Exploited Vulnerabilities
  4. ExploitedYesin real attacks
  5. Fix Steps5actions listedUpgrade to a fixed release · Lock down admin access

What it allows

An attacker who already has an admin profile with at least read-write rights can pass crafted arguments to existing CLI commands and write or delete arbitrary files on the device. Fortinet rates the impact as escalation of privilege. The score is only Medium because the attacker needs high privileges first. CISA still lists the flaw as exploited, so any stolen or weak admin login on these devices is a real risk. Fortinet scores it 6.0 and NVD scores it 6.5, both on CVSS v3.1.

Who is affected

Per Fortinet advisory FG-IR-26-122 and NVD: FortiOS 7.6.0 to 7.6.4 (fixed in 7.6.5), FortiOS 7.4.0 to 7.4.9 (fixed in 7.4.10), and all versions of FortiOS 7.2, 7.0 and 6.4. FortiPAM 1.7.0 (fixed in 1.7.1) and all versions of FortiPAM 1.0 to 1.6. FortiProxy 7.6.0 to 7.6.4 (fixed in 7.6.5), FortiProxy 7.4.0 to 7.4.11 (fixed in 7.4.12), and all versions of FortiProxy 7.2 and 7.0. FortiSwitchManager 7.2.0 to 7.2.7 (fixed in 7.2.8) and 7.0.0 to 7.0.6 (fixed in 7.0.7). FortiPAM 1.8 is not affected. For the branches marked all versions, the advisory says to migrate to a fixed release.

Timeline

  1. 14 Apr 2026

    Fortinet publishes advisory FG-IR-26-122 and NVD publishes the CVE record. The advisory says the vendor found the flaw internally. It now also marks the flaw as known exploited.

  2. 15 Oct 2026

    The NVD record carries a CISA SSVC entry dated this day that marks exploitation as active.

  3. 16 Oct 2026

    CISA adds the CVE to its Known Exploited Vulnerabilities catalog and flags forensic triage as required.

  4. 19 Oct 2026

    CISA due date for federal agencies to apply the vendor mitigations.

What to do

  1. Upgrade to a fixed release

    Move FortiOS to 7.6.5 or 7.4.10, FortiProxy to 7.6.5 or 7.4.12, FortiPAM to 1.7.1, and FortiSwitchManager to 7.2.8 or 7.0.7. Fortinet offers an upgrade path tool for planning the move.

  2. Plan a migration for old branches

    FortiOS 7.2, 7.0 and 6.4, FortiProxy 7.2 and 7.0, and FortiPAM 1.0 to 1.6 have no fix inside the branch. Fortinet says to migrate to a fixed release, so put these devices on the upgrade list first.

  3. Use the virtual patch if you cannot upgrade yet

    Fortinet lists a virtual patch for this flaw. The advisory names it FG-VD-59270 and says it is in FMWP database update 25.120. Treat it as a stopgap, not a fix.

  4. Lock down admin access

    The attack needs an admin profile with read-write rights. Limit admin logins to a management network, turn on a second sign-in step for admins, and remove admin accounts nobody uses.

  5. Detect and hunt

    CISA marks forensic triage as required for this entry. Review admin sessions and CLI command history for unusual file operations, check for files that changed or vanished, and compare the device configuration with a known-good copy. If you suspect misuse, rotate admin passwords and stored credentials.

Questions

Is CVE-2025-61624 dangerous if it only scores Medium?

CISA lists it as exploited, so the score alone should not set your priority. The attacker needs an admin profile first, which makes stolen admin logins the main risk. Fortinet's advisory, first published in April 2026, now marks the flaw as known exploited. It is one of nine flaws listed in our CISA KEV roundup for 13 to 16 October 2026.

Which Fortinet products are affected?

FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. The exact versions and fixes are in Fortinet advisory FG-IR-26-122, and the list on this page follows it.

Has anyone been named as using this flaw?

CISA, NVD and Fortinet name no group or malware, and CISA lists ransomware campaign use as unknown. Palo Alto Networks Unit 42 reported on 14 October 2026 an intrusion in which this flaw was used to reach root on FortiOS devices and install the malware PEERSTITCH. Unit 42 says the attackers first entered through a FortiManager, using CVE-2024-47575. That link comes from Unit 42 alone. See the PEERSTITCH page.

Does Fortinet have other exploited flaws on this site?

Yes. Earlier FortiOS flaws on our site include the SSL-VPN heap overflow CVE-2022-42475. Another is the SSL VPN out-of-bounds write CVE-2024-21762. A third is the authentication bypass CVE-2024-55591. Two incident pages cover Fortinet devices: Fortinet FortiCloud SSO exploitation and Fortinet device credential exposure. Those are separate events and are not linked to this flaw by the sources opened here.

In our research

  1. CISA KEV additions, 13 to 16 Oct 2026: patch order October 2026

Sources

  1. CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA
  2. Known Exploited Vulnerabilities catalog (data file) CISA
  3. CVE-2025-61624 record NIST NVD
  4. FG-IR-26-122 Path Traversal in CLI Fortinet PSIRT

Last updated 19 October 2026

Browse the threat library

Keep exploring

Knowledge Hub