CISA lists Fortinet path traversal CVE-2025-61624 as exploited
Original title: CISA KEV: Fortinet Multiple Products Path Traversal Vulnerability — Fortinet Multiple Products (CVE-2025-61624)
Authenticated admins with read-write rights can write or delete arbitrary files via CLI; the due date is October 19, 2026.
CISA added CVE-2025-61624, a path traversal flaw in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, to the Known Exploited Vulnerabilities catalog. An authenticated attacker with an admin profile and at least read-write permissions may write or delete arbitrary files through specific CLI commands. Required action is to apply vendor mitigations under BOD 26-04 by October 19, 2026, or discontinue use if mitigations are unavailable. Known ransomware campaign use is listed as unknown.
Unconfirmed: CISA lists known ransomware campaign use as unknown and states no fixed versions.
- FortiOS ranges include 7.6.0 through 7.6.4 and 7.4.0 through 7.4.9, plus older branches.
- FortiProxy 7.6.0 through 7.6.4 and 7.4.0 through 7.4.11 are listed.
- FortiSwitchManager 7.2.0 through 7.2.7 and 7.0.0 through 7.0.6 are listed.
- The catalog gives no fixed versions.
Impact: Authenticated admin can write or delete arbitrary files
| Product | Affected |
|---|---|
| Fortinet FortiOS | 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2 all versions, 7.0 all versions, 6.4 all versions |
| Fortinet FortiPAM | 1.7.0, 1.6 all versions, 1.5 all versions, 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions |
| Fortinet FortiProxy | 7.6.0 through 7.6.4, 7.4.0 through 7.4.11, 7.2 all versions, 7.0 all versions |
| Fortinet FortiSwitchManager | 7.2.0 through 7.2.7, 7.0.0 through 7.0.6 |
- 1.Apply vendor mitigations in line with CISA BOD 26-04 by October 19, 2026.
- 2.Follow CISA forensics triage requirements cited in the KEV entry.
- 3.Discontinue use if mitigations are unavailable.
- CVEs
- CVE-2025-61624
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-61624 | Authenticated path traversal in Fortinet FortiOS and related products | 6.5 | 1% | KEV | KEV |
From the original article
1 min read at cisa.govAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7. 6. 0 through 7.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.