U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Fortinet and BeyondTrust flaws to KEV, with a federal fix deadline of October 19.
88
CVE-2025-61624
Authenticated path traversal in Fortinet FortiOS and related products
CISA: Fortinet Multiple Products Path Traversal Vulnerability
- CVSS 3.1
- 6.5 medium
- EPSS
- 1%p71
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2025-61624 is a path traversal flaw (CWE-22) in multiple Fortinet products that fails to keep a pathname inside a restricted directory. An attacker who is already authenticated with an administrator profile and at least read-write permissions can use specific CLI commands to write or delete arbitrary files. The impact is high integrity and availability loss with no confidentiality impact scored (CVSS 3.1 base 6.5); it is not an unauthenticated remote code execution bug. Affected products are FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager in the version ranges listed by Fortinet. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-16, so exploitation in the wild is confirmed, while ransomware use is listed as unknown and no public proof-of-concept is known; related reporting describes stealthy FortiGate implants but does not by itself identify this CVE as the sole intrusion path.
What to do: Apply Fortinet's fixes or mitigations for every listed FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager release, following CISA BOD 26-04; do not treat a specific build as safe unless the vendor advisory names it. Limit CLI access to trusted administrators with read-write profiles, and review admin accounts and logs for unexpected file writes or deletions. Because this CVE is in CISA's KEV catalog, also follow CISA's forensics triage guidance and discontinue use if a mitigation is unavailable.
| Product | Affected |
|---|---|
| Fortinet FortiOS | 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2 all versions, 7.0 all versions, 6.4 all versions |
| Fortinet FortiPAM | 1.7.0, 1.6 all versions, 1.5 all versions, 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions |
| Fortinet FortiProxy | 7.6.0 through 7.6.4, 7.4.0 through 7.4.11, 7.2 all versions, 7.0 all versions |
| Fortinet FortiSwitchManager | 7.2.0 through 7.2.7, 7.0.0 through 7.0.6 |
Estimated exposure
largeon the order of 10,000–100,000+ Fortinet appliances potentially in affected ranges — FortiOS and related Fortinet appliances are widely deployed enterprise products, and public internet scans commonly show on the order of tens to low hundreds of thousands of exposed Fortinet devices; this dataset has no install count, not…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
KEVCISA Known Exploited Vulnerability
- Affected
- Fortinet Multiple Products
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Products
- fortios, fortipam, fortiproxy, fortiswitchmanager, ruggedcom ape1808 firmware
- Weakness
- CWE-22
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
In the news
9 storiesUNC5820 used Fortinet zero-days to plant PeerStitch at a telecom
CISA added CVE-2025-61624 to KEV; the memory-only implant rides legitimate FortiGate process traffic.
84
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
Unit 42 says CL-STA-0954 used Fortinet flaws to deploy memory-resident PEERSTITCH against a telecom provider.
84
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
Unit 42 says UNC5820 stole data on 500-plus FortiGates and deployed memory-resident PEERSTITCH malware.
84
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
Unit 42 says PEERSTITCH, planted through FortiManager flaws, exposed material for more than 500 firewalls.
82
Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Attackers exploited Fortinet flaws at a telecom MSP and deployed the stealthy PEERSTITCH implant on FortiGate firewalls.
82
New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory
Unit 42 details PEERSTITCH, a memory-resident implant used against FortiGate firewalls at a telecom MSP.
80
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited Fortinet and BeyondTrust flaws to the Known Exploited Vulnerabilities catalog.
79
CISA lists Fortinet path traversal CVE-2025-61624 as exploited
Authenticated admins with read-write rights can write or delete arbitrary files via CLI; the due date is October 19, 2026.
76