CVE-2025-61624FortinetFirewall and VPNOctober 16, 2026

Fortinet Multiple Products Path Traversal Vulnerability

Medium 6Actively exploited

Description

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

What to do

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Running Fortinet devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on Fortinet alerts

Details

Vendor
Fortinet
Product
FortiOS, FortiPAM, FortiProxy, FortiSwitchManager
CVE
CVE-2025-61624
Affected versions
FortiOS 7.6: from 7.6.0 to 7.6.4
FortiOS 7.4: from 7.4.0 to 7.4.9
FortiOS 7.2: from 7.2.0 to 7.2.13
FortiOS 7.0: from 7.0.0 to 7.0.19
FortiOS 6.4: from 6.4.0 to 6.4.16
FortiProxy 7.6: from 7.6.0 to 7.6.4
FortiProxy 7.4: from 7.4.0 to 7.4.11
FortiProxy 7.2: from 7.2.0 to 7.2.16
FortiProxy 7.0: from 7.0.0 to 7.0.23
FortiSwitchManager 7.2: from 7.2.0 to 7.2.7
FortiSwitchManager 7.0: from 7.0.0 to 7.0.6
FortiPAM 1.7: 1.7.0
FortiPAM 1.6: from 1.6.0 to 1.6.2
FortiPAM 1.5: from 1.5.0 to 1.5.1
FortiPAM 1.4: from 1.4.0 to 1.4.3
FortiPAM 1.3: from 1.3.0 to 1.3.1
FortiPAM 1.2: 1.2.0
FortiPAM 1.1: from 1.1.0 to 1.1.2
FortiPAM 1.0: from 1.0.0 to 1.0.3 (from the advisory and NVD; check the exact builds in the official advisory)
CVSS score
6
Actively exploited
Yes, listed in the CISA Known Exploited Vulnerabilities catalog
CISA due date
October 19, 2026 (deadline for US federal agencies: a good benchmark for you too)
Source
CISA KEV – original advisory
Published
October 16, 2026

The description and the recommended action are quoted from the public advisory; severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.

More Fortinet advisories