Fortinet path traversal flaw is now exploited: what to patch and who it affects

CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities (KEV) catalog on October 16, 2026, listing it as a Fortinet path traversal vulnerability in multiple products. Fortinet published the flaw and its fixes in April, so this is a patch you may already be able to apply. The new part is that exploitation has been confirmed.

What it is

According to the CVE record Fortinet published, an attacker who is already logged in with an admin profile that has read-write permissions can use specific command-line (CLI) commands to write or delete arbitrary files on the device. It is rated medium (CVSS 5.4) because it is not reachable by an anonymous attacker.

That rating is easy to underrate. An attacker who has stolen an admin password, or who reached the management interface through another bug, can use this flaw to go further on the device. If your management interface is exposed to the internet, treat this as higher priority than the score suggests.

Fortinet’s record does not say how the exploitation is happening, and neither does CISA’s entry, so this article doesn’t guess.

Who is affected

Product	Affected versions	Fix
FortiOS 7.6	7.6.0 through 7.6.4	7.6.5 or later
FortiOS 7.4	7.4.0 through 7.4.9	7.4.10 or later
FortiOS 7.2, 7.0, 6.4	All versions	No fix listed. Move to a fixed release.
FortiProxy 7.6	7.6.0 through 7.6.4	7.6.5 or later
FortiProxy 7.4	7.4.0 through 7.4.11	7.4.12 or later
FortiProxy 7.2, 7.0	All versions	No fix listed. Move to a fixed release.
FortiSwitchManager 7.2	7.2.0 through 7.2.7	7.2.8 or later
FortiSwitchManager 7.0	7.0.0 through 7.0.6	7.0.7 or later
FortiPAM	1.0 through 1.7.0	1.7.1 or 1.8.0 or later

Fortinet’s record lists a FortiOS 8.0.0 release as a future fix, and says FortiSASE was already fixed on Fortinet’s side, so FortiSASE customers don’t need to act. Fortinet lists no workaround, so the fix is the upgrade.

What to do

1. Find your version. On a FortiGate, run get system status or look at the dashboard. Compare it against the table above.
2. Upgrade to a fixed release. Fortinet’s upgrade path tool shows the steps between versions. If you are on 7.2, 7.0 or 6.4, plan the move to 7.4 or 7.6 now.
3. Check who has admin access. Remove admin accounts nobody uses, and make sure every remaining admin account has a strong unique password and multi-factor authentication.
4. Limit where the management interface answers. Allow admin logins only from a trusted management network or VPN, never from the open internet.
5. Review the device if you cannot upgrade today. Look at recent admin logins and configuration changes in the logs for anything you do not recognize.

If you find unexpected admin activity, treat the device as compromised: change all admin and VPN credentials, and get help from your incident response contact before you reboot or reset anything. Our incident response plan checklist is a place to start.

CISA’s remediation deadline for federal agencies was October 19, 2026. Public-sector and bank shops should use the same timeline as a sensible target, and confirm any formal requirements with your CJIS Systems Agency, examiner or counsel.

Sources

• CVE-2025-61624 record (published by Fortinet as the CVE numbering authority): description, affected versions, CVSS score, and fixed versions
• Fortinet PSIRT advisory FG-IR-26-122 (Fortinet): the advisory referenced from the CVE record
• CISA adds two known exploited vulnerabilities to catalog (CISA): the October 16, 2026 KEV addition
• Known Exploited Vulnerabilities catalog (CISA): due date of October 19, 2026
• Fortinet upgrade path tool (Fortinet)