Fortinet Path Traversal CVE-2025-61624 Added to CISA KEV: Affected Versions and Patch Guidance

Introduction

Short answer:** CISA added **CVE-2025-61624** to its Known Exploited Vulnerabilities catalog on **October 16, 2026**, with a remediation due date of **October 19, 2026**. The vulnerability affects multiple Fortinet products and involves path traversal in the command-line interpreter. A privileged attacker with an administrator profile and at least read-write permissions may be able to write or delete arbitrary files through specially crafted CLI commands. Fortinet rates the issue **CVSS 3.1 Medium**, but the KEV listing makes it an urgent risk-prioritization and investigation item because exploitation evidence exists. [1] [2] [3]

**Key Takeaways**

- CVE-2025-61624 affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager versions listed in the Fortinet advisory.

- This is not an unauthenticated internet attack according to the published vulnerability description. The attacker needs a privileged administrative profile with read-write permissions.

- The impact can still be serious because arbitrary file write or delete capability may support privilege escalation, configuration tampering or persistence.

- CISA’s KEV entry requires forensic triage under BOD 26-04 and gives October 19, 2026 as the listed due date.

- Upgrade to Fortinet’s fixed releases or follow the vendor’s migration path. A virtual patch is available through FortiManager Web Filter Patch for supported deployments, but it is not a substitute for upgrading when an upgrade is possible. [2]

What is CVE-2025-61624?

CVE-2025-61624 is a **path-traversal vulnerability in the CLI** of several Fortinet products. Fortinet’s PSIRT advisory says the weakness may allow a privileged attacker to achieve arbitrary file write or delete operations through specifically crafted arguments to existing commands. The CVE record classifies the issue as **CWE-22, Improper Limitation of a Pathname to a Restricted Directory**. [1] [3]

Path traversal occurs when an application or command interprets a pathname beyond the directory or location that the developer intended to permit. In this case, the vulnerable path is connected to CLI command processing. The published description does not say that any unauthenticated visitor can exploit the issue. It describes an authenticated attacker with an administrator profile and at least read-write permissions.

That access requirement lowers the number of people who can directly trigger the flaw, but it does not make the risk unimportant. Administrative accounts are valuable targets. If an attacker already has a privileged Fortinet account through credential theft, insider misuse, a compromised management workstation or another weakness, file write and delete operations can become a bridge to deeper control.

Why did CISA add it to the KEV catalog?

CISA added CVE-2025-61624 to the KEV catalog on October 16, 2026, alongside CVE-2026-102764 affecting BeyondTrust Remote Support. CISA said the additions were based on evidence of active exploitation. The catalog lists a due date of October 19, 2026 and marks forensic triage as required under BOD 26-04. [1] [2]

The KEV status changes the operational priority. CVSS describes the technical severity under a defined scoring model. KEV status signals that defenders should treat the vulnerability as known to be exploited and prioritize remediation based on real-world risk. A Medium CVSS score and an urgent patching priority are not contradictory.

CISA’s federal requirements apply directly to Federal Civilian Executive Branch agencies. CISA also encourages all organizations to adopt risk-based vulnerability management and prioritize KEV vulnerabilities. Private companies, schools, hospitals and Indian organizations should use their own risk, exposure, contractual and regulatory processes while treating this entry as a strong signal to act quickly. [1]

### What does the October 19 date mean?

The October 19, 2026 date is the due date shown in the CISA KEV catalog. It is not a promise that exploitation begins on that date, and it is not a universal legal deadline for every organization. It is a clear prioritization marker. Teams should identify exposed assets, apply the vendor fix or approved mitigation, and begin compromise checks without waiting for the due date.

Which Fortinet products and versions are affected?

Fortinet lists the following affected product families and remediation paths in advisory FG-IR-26-122:

The CVE record provides more granular affected-version ranges for several branches, including FortiOS 7.2.0 through 7.2.13, FortiOS 7.0.0 through 7.0.19, FortiOS 6.4.0 through 6.4.16, FortiProxy 7.2.0 through 7.2.16, FortiProxy 7.0.0 through 7.0.23 and FortiPAM maintenance ranges. Use the Fortinet advisory and upgrade tool for the exact branch and supported migration path rather than relying on a shortened list in a news article. [1] [3]

• **FortiOS:** 7.6.0 through 7.6.4 should upgrade to 7.6.5 or later. FortiOS 7.4.0 through 7.4.9 should upgrade to 7.4.10 or later. FortiOS 7.2, 7.0 and 6.4 require migration to a fixed release.
• **FortiProxy:** 7.6.0 through 7.6.4 should upgrade to 7.6.5 or later. Versions 7.4.0 through 7.4.11 should upgrade to 7.4.12 or later. FortiProxy 7.2 and 7.0 require migration to a fixed release.
• **FortiSwitchManager:** 7.2.0 through 7.2.7 should upgrade to 7.2.8 or later. Versions 7.0.0 through 7.0.6 should upgrade to 7.0.7 or later.
• **FortiPAM:** version 1.8 is listed as not affected. FortiPAM 1.7.0 should upgrade to 1.7.1 or later. FortiPAM 1.6 and older branches require migration to a fixed release.

How does the Fortinet path traversal vulnerability work?

The vulnerability is reached through existing CLI commands that process pathname arguments. A privileged attacker supplies crafted input that causes the command to address a file outside the intended restricted directory. The resulting operation may write or delete a file that should not be under the attacker’s control.

A path traversal problem is not automatically a complete device takeover. The outcome depends on the command, the file target, the account permissions, the product, the deployment configuration and the attacker’s existing access. Public advisories do not provide a safe reason to publish a working exploit chain. Defenders need enough information to identify affected assets and patch them, not a copy-and-paste attack recipe.

Potential security consequences can include changed configuration, tampered scripts, deleted evidence, altered system files or a path toward privilege escalation. The KEV listing and Fortinet advisory establish the vulnerability and exploitation status; they do not prove that every affected device has suffered each of these outcomes.

What should Fortinet administrators do first?

### 1. Inventory Fortinet products and management paths

Identify FortiGate systems running FortiOS, FortiProxy appliances, FortiPAM deployments and FortiSwitchManager instances. Include production, disaster-recovery, lab and branch systems. Record the exact product version, management interfaces, administrative accounts, network exposure, update path and business owner.

Search more than the central asset database. Fortinet devices may be managed by network, cloud, security or regional teams. Review firewall rules, VPN access, jump hosts, configuration backups, DNS records and service-provider documentation for systems that are not visible in a standard inventory.

### 2. Check privileged access

Because the published description requires an authenticated administrator with read-write permissions, review which accounts can use the CLI and which systems can reach the management interface. Remove unnecessary administrator permissions, disable stale accounts and require strong multifactor authentication where the product and architecture support it.

This is a risk-reduction step, not a patch replacement. If a legitimate administrator account or management workstation has already been compromised, permission cleanup alone may not remove malicious changes made earlier.

### 3. Upgrade through the supported path

Apply the fixed release listed by Fortinet for the installed branch. For branches marked “migrate to a fixed release,” follow the Fortinet upgrade tool and supported-version documentation. Check configuration compatibility, HA behavior, backup integrity and rollback procedures before the maintenance window.

Fortinet also lists a virtual patch named **FG-VD-59270.0day** in FortiManager Web Filter Patch database update 25.120. Treat that as a mitigation option for an appropriate supported deployment, not as a reason to postpone a full product upgrade. Confirm applicability and support status with the vendor’s current documentation.

### 4. Restrict management exposure

Limit administrative interfaces to trusted networks and approved jump hosts. Remove direct internet exposure where it is not needed. Review management-plane firewall rules, remote administration paths and service-provider access. A smaller attack surface reduces opportunity while the upgrade is being prepared.

Do not confuse management-plane restriction with remediation. If a device was reachable or an administrative account was exposed during the relevant period, perform compromise checks even after access is restricted.

What evidence should teams review after patching?

CISA’s catalog marks forensic triage as required under BOD 26-04. That means the response should include more than checking whether a new firmware image installed successfully. Teams should determine whether the vulnerable path was used before remediation and whether an administrator account or management system was already compromised. [2]

Review Fortinet CLI history, administrator login records, configuration changes, system events, authentication logs, network flows and centralized logging for the exposure window. Pay particular attention to:

A missing log entry is not proof that nothing happened. An attacker with sufficient access may alter local records or exploit a path that does not produce the event an administrator expects. Correlate appliance records with identity-provider logs, privileged-access-management records, jump-host logs, SIEM events, DNS, VPN and perimeter telemetry.

If compromise is suspected, preserve evidence before resetting or rebuilding the device. Coordinate isolation, forensic imaging and credential rotation with qualified incident responders. Rotate administrator passwords, API keys, certificates and other secrets that may have been exposed, and review connected systems for lateral movement.

• New or unexpected administrator accounts and role changes.
• Administrator logins from unusual addresses, devices or time periods.
• CLI commands that do not match approved maintenance work.
• Unexpected file creation, deletion or modification.
• Changes to firewall policy, routing, VPN, certificates, local users or authentication integrations.
• Gaps in logs, unexpected logging changes or disabled forwarding.
• Configuration exports or backups created outside the normal process.
• New management connections from unfamiliar jump hosts or service providers.

Does this affect organizations in India?

The public advisories do not establish a confirmed India-specific incident for CVE-2025-61624. Indian organizations can still be exposed if they operate an affected Fortinet product, use a managed network service with an affected device, or permit remote administration through an exposed management path.

Indian security teams should identify whether the affected device supports critical services, regulated data or third-party connectivity. They should also evaluate applicable CERT-In, contractual, sector-specific and legal reporting obligations with qualified advisers if evidence of compromise is found. This article does not provide a compliance determination for any particular organization.

For related education, readers can continue to CYBERoinfo’s [vulnerability guide](/articles/zero-day-vulnerabilities), [network security concepts](/articles/basic-network-security-concepts), [security operations guide](/articles/security-operations-soc-siem-xdr-soar), and [India cybersecurity guide](/articles/india-cybersecurity).

Frequently asked questions

### Is CVE-2025-61624 a critical vulnerability?

Fortinet lists the issue as Medium with a CVSS 3.1 score of 6.0. CISA has nevertheless added it to the KEV catalog because exploitation evidence exists. Organizations should treat KEV status as an urgent remediation and investigation signal even when the CVSS rating is not Critical.

### Is CVE-2025-61624 remotely exploitable without login?

The published CVE description says the attacker must be authenticated and have an administrator profile with at least read-write permissions. The exact exposure depends on the product, management path, account controls and deployment. “Authenticated” does not mean low risk because privileged account compromise is a common security problem.

### Which Fortinet products are affected?

The official advisory covers FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. Affected branches and fixed versions differ by product. Check the exact Fortinet advisory and version-specific upgrade path rather than applying a single product-wide rule.

### What is the CISA KEV due date for CVE-2025-61624?

CISA’s catalog lists October 19, 2026 as the due date. Federal agencies should follow applicable BOD 26-04 requirements. Other organizations should use the date as an urgent risk-prioritization marker and act as soon as possible.

### Is there a virtual patch?

Fortinet lists virtual patch FG-VD-59270.0day in FortiManager Web Filter Patch database update 25.120. Confirm that the mitigation applies to the specific deployment and keep the supported product upgrade as the preferred long-term remediation when feasible.

Final perspective

CVE-2025-61624 shows why vulnerability priority cannot be decided by CVSS alone. The issue has a Medium CVSS rating and requires privileged authenticated access, but it is still listed in CISA’s KEV catalog because exploitation evidence exists. That combination points to a focused response: inventory affected Fortinet products, reduce management exposure, upgrade through the supported path, and perform forensic checks for activity before the patch.

The safest conclusion is neither “every device is compromised” nor “the issue is harmless because login is required.” The evidence supports a more useful position: affected Fortinet devices deserve urgent, risk-based remediation and investigation.

Private SEO keyword set

CVE-2025-61624 Fortinet; Fortinet path traversal vulnerability; CISA KEV CVE-2025-61624; Fortinet vulnerability October 2026; FortiOS path traversal; FortiProxy vulnerability; FortiPAM vulnerability; FortiSwitchManager vulnerability; Fortinet CLI vulnerability; Fortinet security advisory; Fortinet KEV patch; CVE-2025-61624 affected versions; Fortinet arbitrary file write; Fortinet vulnerability exploited; Fortinet patch guide; how to fix CVE-2025-61624

References

[1]: https://fortiguard.fortinet.com/psirt/FG-IR-26-122 "Fortinet PSIRT FG-IR-26-122: Path Traversal in CLI"

[2]: https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog "CISA Adds Two Known Exploited Vulnerabilities to Catalog"

[3]: https://nvd.nist.gov/vuln/detail/CVE-2025-61624 "NVD CVE-2025-61624 Detail"

[4]: https://www.cve.org/CVERecord?id=CVE-2025-61624 "CVE-2025-61624 Record"

[5]: https://www.cisa.gov/known-exploited-vulnerabilities-catalog "CISA Known Exploited Vulnerabilities Catalog"

Decision checklist

• **FortiOS:** 7.6.0 through 7.6.4 should upgrade to 7.6.5 or later. FortiOS 7.4.0 through 7.4.9 should upgrade to 7.4.10 or later. FortiOS 7.2, 7.0 and 6.4 require migration to a fixed release.
• **FortiProxy:** 7.6.0 through 7.6.4 should upgrade to 7.6.5 or later. Versions 7.4.0 through 7.4.11 should upgrade to 7.4.12 or later. FortiProxy 7.2 and 7.0 require migration to a fixed release.
• **FortiSwitchManager:** 7.2.0 through 7.2.7 should upgrade to 7.2.8 or later. Versions 7.0.0 through 7.0.6 should upgrade to 7.0.7 or later.
• **FortiPAM:** version 1.8 is listed as not affected. FortiPAM 1.7.0 should upgrade to 1.7.1 or later. FortiPAM 1.6 and older branches require migration to a fixed release.
• New or unexpected administrator accounts and role changes.
• Administrator logins from unusual addresses, devices or time periods.
• CLI commands that do not match approved maintenance work.
• Unexpected file creation, deletion or modification.
• Changes to firewall policy, routing, VPN, certificates, local users or authentication integrations.
• Gaps in logs, unexpected logging changes or disabled forwarding.
• Configuration exports or backups created outside the normal process.
• New management connections from unfamiliar jump hosts or service providers.

Limitations

• Reporting channels, procedures and security guidance can change; verify current instructions before acting.

Evidence sources

1. fortiguard.fortinet.com — Fortinet PSIRT FG-IR-26-122
2. cisa.gov — CISA KEV Announcement
3. nvd.nist.gov — NVD CVE-2025-61624 Detail
4. cve.org — CVE-2025-61624 Record