Fortinet CLI path traversal (CVE-2025-61624) in FortiOS, FortiProxy, FortiPAM and FortiSwitchManager is now exploited
An admin-level CLI path traversal patched in April is now on CISA’s exploited list. Upgrade FortiOS to 7.6.5 or 7.4.10 and audit admin accounts.
- Published
- Updated
- Ecosystem
- Network edge
- Fixed in
- FortiOS 7.6.5, 7.4.10; FortiProxy 7.6.5, 7.4.12; FortiPAM 1.7.1; FortiSwitchManager 7.2.8, 7.0.7; FortiOS 7.2, 7.0, 6.4 and FortiProxy 7.2, 7.0 must migrate
- Exploitation
- Yes. Fortinet’s advisory marks it known exploited; in CISA KEV since 16 October 2026
Live scores
CVE-2025-61624- EPSS
- 0.013
some chance of attack soon - VEDAS
- 0.510
some exploit evidence - On CISA KEV
- Yes, since 2026-10-16
- Detection rule
- Out of scope (local)
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
VEDAS flagged this bug about 44 days before CISA confirmed attacks.
What happened
On 14 April 2026, Fortinet published FG-IR-26-122 for CVE-2025-61624. It is a path traversal in the command line interpreter of FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. A privileged attacker can pass crafted arguments to existing CLI commands to write or delete arbitrary files. Fortinet rates it Medium, CVSS 6.0, and says it was found internally (Fortinet). The CVE record says the attacker needs an admin profile with at least read-write permissions (CVE record).
Fortinet’s advisory now marks it as known exploited. CISA added it to the KEV catalog on 16 October 2026 with a federal due date of 19 October (CISA KEV). Neither Fortinet nor CISA has said who is exploiting it or published indicators.
Why this matters
A Medium rating hides the real use. An attacker who has stolen or guessed a FortiGate admin password can already change the configuration. Arbitrary file write and delete goes further: it can plant files on the appliance or remove evidence. So treat this as a way to dig in after an admin compromise, and check admin access, not just the version. Earlier this year an attacker took over hundreds of FortiGates with exposed admin ports and reused passwords alone (our advisory).
Am I affected?
Affected and fixed versions (Fortinet):
| Product | Affected | Fix |
|---|---|---|
| FortiOS 7.6 | 7.6.0 to 7.6.4 | 7.6.5 or above |
| FortiOS 7.4 | 7.4.0 to 7.4.9 | 7.4.10 or above |
| FortiOS 7.2, 7.0, 6.4 | All versions | Migrate to a fixed release |
| FortiProxy 7.6 | 7.6.0 to 7.6.4 | 7.6.5 or above |
| FortiProxy 7.4 | 7.4.0 to 7.4.11 | 7.4.12 or above |
| FortiProxy 7.2, 7.0 | All versions | Migrate to a fixed release |
| FortiPAM 1.7 | 1.7.0 | 1.7.1 or above |
| FortiPAM 1.0 to 1.6 | All versions | Migrate to a fixed release |
| FortiSwitchManager 7.2 | 7.2.0 to 7.2.7 | 7.2.8 or above |
| FortiSwitchManager 7.0 | 7.0.0 to 7.0.6 | 7.0.7 or above |
FortiPAM 1.8 is not affected. FortiSASE was fixed by Fortinet and needs no action (CVE record).
On FortiOS or FortiProxy, check the version from the CLI:
get system statusThen list who can log in as an administrator and with which profile:
show system adminAny account with a read-write admin profile can reach this bug.
What to do now
- Upgrade to the fixed version for your branch. If you are on FortiOS 7.2, 7.0 or 6.4, plan the move to 7.4.10 or 7.6.5 now; use Fortinet’s upgrade path tool for the supported hops.
- If you cannot upgrade yet, FortiGuard publishes a virtual patch, FG-VD-59270.0day, in FMWP database update 25.120 (Fortinet).
- Audit admin accounts. Remove admin accounts nobody owns, reduce read-write profiles to the people who need them, and enforce MFA on administrator logins.
- Restrict where admins log in from. Set trusted hosts on admin accounts and remove HTTPS and SSH administrative access from internet-facing interfaces.
- Look for signs of use. No indicators are published. Review system event logs for admin logins from unfamiliar IPs and for CLI sessions you cannot account for, especially since the April disclosure. If you find an unexplained admin login, treat the device as compromised: CISA requires forensic triage for this entry, so preserve logs and configuration before you rebuild.