Fortinet Multiple Products, CVE-2025-61624: on CISA's exploited list

The bottom line

If you run FortiOS, FortiProxy, FortiPAM or FortiSwitchManager, act now: the CISA date has already passed. First find your version and who holds read-write admin accounts. If you run none of these, stop reading.

Free analysis report · 10 pagesFortinet Multiple Products, CVE-2025-61624: on CISA's exploited listThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

An attacker who is already logged in as an administrator with at least read-write permissions can use crafted CLI commands to write or delete files of their choosing on the device. The attacker needs that admin login first.

Why it matters

The vendor rates this Medium, but it is listed as exploited. Our reading is that a file write or delete on a security device is useful to an attacker who already holds admin access: it can change what the device does or remove traces. The record does not say what was written or deleted in attacks. A modest score is no reason to delay.

What the vendor's advisory says

We read one page on fortiguard.fortinet.com. In short:

• The vendor's advisory (FG-IR-26-122, 14 April 2026) rates it Medium, CVSSv3 6.0, attack type authenticated, and marks it as known exploited.
• It says FortiOS 7.2, 7.0 and 6.4 are affected in all versions, with no fixed release in those branches: the advice is to migrate.
• FortiPAM 1.6 and earlier are affected in all versions; FortiPAM 1.7.0 is fixed in 1.7.1; FortiPAM 1.8 is not affected.
• The advisory says a virtual patch is available in database update 25.120, for customers who use that service.
• The advisory points to the vendor's upgrade tool for the recommended upgrade path.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• "Medium score, so it can wait." The vendor marks it as known exploited and CISA lists it. The score does not describe that.
• "It needs a login, so it is not our problem." The login needed is an admin with read-write rights. The record does not say how attackers get one, so check who holds such accounts.
• "Our FortiOS is old but stable, so we are fine." The advisory lists FortiOS 7.2, 7.0 and 6.4 as affected in all versions and says to migrate.

The wording includes conditions the score may not show: the attacker must be logged in. Read the record before you decide it does not apply to you.

How we would triage it

This is our judgement.

The commands only read: they print a version or list what is installed. They come from general knowledge of this kind of product, not from the sources, so check them against the vendor's page before you run them. Words in capitals are for you to fill in.

Step 1: Find the versions you run

• List every FortiOS, FortiProxy, FortiPAM and FortiSwitchManager device and its version.
• Compare each against the fixed versions: older branches have no fix in-branch.

get system status

Step 2: Reduce who can use the CLI

• List admin accounts and remove any read-write profile that is not needed, since the flaw needs one.
• Limit admin login to a management network and trusted addresses.

show system admin

Step 3: Patch or migrate

• Upgrade to a fixed version, or migrate if your branch has none, using the vendor's upgrade path.
• If you cannot patch at once, ask whether the vendor's virtual patch (database update 25.120) applies to you.

Step 4: Check for signs of misuse

• Review admin logins and CLI activity for accounts or times you do not recognise.
• Look for files that were changed or are missing without a change request.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

Hello. Please tell us whether we run FortiOS, FortiProxy, FortiPAM or FortiSwitchManager, and where. For each, please give the exact version. The vendor's advisory for CVE-2025-61624 lists fixed versions: FortiOS 7.6.5 or 7.4.10, FortiProxy 7.6.5 or 7.4.12, FortiPAM 1.7.1, FortiSwitchManager 7.2.8 or 7.0.7. Older branches need migration. CISA lists this flaw as exploited and its date has passed. Please also list who holds read-write admin accounts. Please confirm the version and the fix to us in writing by a date you propose this week. Thank you.

Signs it was used

An update closes the hole. It does not tell you whether someone used it first. CISA's required action points to its forensic triage requirements (BOD 26-04). Look for:

• Admin logins at unusual times or from addresses you do not recognise.
• CLI commands run by admin accounts that no one can account for.
• Files on the device that have changed or disappeared without a planned change.

The weakness behind it

The record classes this as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory →What this kind of mistake is, and which exploited vulnerabilities share it.

The sources, in their words

CISA's catalogue entry:

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

The CVE record, published by Fortinet on 14 April 2026:

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker …

Versions of Fortinet FortiOS the record lists as affected:

• 7.6.0 through 7.6.4
• 7.4.0 through 7.4.9
• 7.2.0 through 7.2.13
• 7.0.0 through 7.0.19
• 6.4.0 through 6.4.16

Versions of Fortinet FortiProxy the record lists as affected:

• 7.6.0 through 7.6.4
• 7.4.0 through 7.4.11
• 7.2.0 through 7.2.16
• 7.0.0 through 7.0.23

Versions of Fortinet FortiSwitchManager the record lists as affected:

• 7.2.0 through 7.2.7
• 7.0.0 through 7.0.6

Versions of Fortinet FortiPAM the record lists as affected:

• 1.7.0
• 1.6.0 through 1.6.2
• 1.5.0 through 1.5.1
• 1.4.0 through 1.4.3
• 1.3.0 through 1.3.1
• 1.2.0
• 1.1.0 through 1.1.2
• 1.0.0 through 1.0.3

CISA's required action:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

What we do not know yet

• Which files attackers wrote or deleted, and how they got the admin login, are not stated.
• No source names a fixed release for FortiOS 7.2, 7.0 or 6.4; the advice is only to migrate.
• The sources do not say whether the virtual patch fully blocks the flaw.
• The advisory says the flaw was found internally; the sources do not describe the attacks.
• We have not tested this against any environment. Versions and scores are as the sources state them and as at 1 November 2026; the vendor's advisory wins where it differs.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.
• The CVE Triage Handbook →How to check, analyse and triage a CVE. Free with registration.