CISA Adds Exploited Fortinet Path Traversal to KEV
Tech GuruQuick Answer
CISA added Fortinet CVE-2025-61624 to KEV on October 16, confirming known exploitation. The flaw affects specific FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager branches and requires an authenticated attacker with a privileged profile. Inventory exact releases and privileged CLI access, preserve evidence, install the branch-specific fixed release, and complete required action by October 19 where applicable.
Validate Privileged CLI Exposure, Update, And Triage
What to do now: Inventory affected Fortinet systems and privileged administrators, preserve configuration and audit evidence, apply the advisory-listed fixed release or migrate an unsupported branch, validate management and traffic functions, and document the October 19 CISA disposition where applicable.
Last verified: 2026-10-17 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager releases listed in FG-IR-26-122 |
|---|---|
| Advisory | FG-IR-26-122 / CISA KEV: CVE-2025-61624 |
| CVE | CVE-2025-61624 |
| Authoritative release date | 2026-10-16 (CISA KEV addition; Fortinet initially published FG-IR-26-122 on 2026-04-14) |
| Authority revision date | 2026-10-16 17:15:48.8752 UTC (CISA KEV catalog release) |
| Affected versions | FortiOS 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, and all 7.2, 7.0, and 6.4 releases; FortiPAM 1.7.0 and all 1.6 through 1.0 releases; FortiProxy 7.6.0 through 7.6.4, 7.4.0 through 7.4.11, and all 7.2 and 7.0 releases; and FortiSwitchManager 7.2.0 through 7.2.7 and 7.0.0 through 7.0.6 |
| Fixed version | FortiOS 7.6.5 or 7.4.10; FortiPAM 1.7.1; FortiProxy 7.6.5 or 7.4.12; FortiSwitchManager 7.2.8 or 7.0.7; affected older branches must migrate to a fixed release |
| CVSS base score | 6.0 (official CVSS v3) |
| CVSS severity | Medium |
| Exploitation status | Known exploited: confirmed by CISA KEV and Fortinet; ransomware campaign use is Unknown; no exploitation claim is inferred. |
What Changed
CISA added CVE-2025-61624 to the Known Exploited Vulnerabilities Catalog on October 16. Fortinet states that an authenticated attacker with a privileged profile can use crafted CLI arguments to write or delete arbitrary files and marks the issue as known exploited.
What To Validate Now
- Inventory. Record product, exact release, management exposure, HA role, administrative profiles, CLI access paths, configuration backup, owner, and supported upgrade path for every potentially affected Fortinet system.
- Establish applicability. Match each system to FG-IR-26-122. The issue requires an authenticated attacker with a privileged profile and at least read-write permissions; do not infer compromise or applicability from the product family alone.
- Remediate. Upgrade to the listed fixed release for the installed branch, or migrate an older affected branch to a supported fixed release. Fortinet also lists virtual patch FG-VD-59270.0day in FMWP database update 25.120.
- Validate. Confirm the resulting release on every HA member, validate management-plane access, CLI operations, policy deployment, traffic handling, failover, logging, and backups, and complete the CISA-required forensic triage.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Preserve administrator audit logs, configuration revisions, command history, file-integrity evidence, authentication records, and network telemetry before remediation. CISA lists ransomware use as Unknown; known exploitation does not prove that a particular system was compromised.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
