Catalog analysis: CISA added this entry on October 16, 2026. The entry reflects catalog information retrieved on October 16, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.
What the vulnerability is
CVE-2025-61624 is a path traversal vulnerability (CWE-22) affecting several Fortinet products. The flaw enables an attacker to execute specific CLI commands to write or delete arbitrary files on the system. This vulnerability requires the attacker to be authenticated and possess an admin profile with at least read-write permissions.
Exposure and applicability
This vulnerability applies to organizations deploying the following Fortinet products:
* FortiOS
* FortiPAM
* FortiProxy
* FortiSwitchManager
Exposure is limited to accounts that meet the specific privilege requirements (authenticated admin with read-write access). Organizations should prioritize assets where these administrative privileges are granted to a wider group of users or where those accounts are more susceptible to compromise.
Remediation priorities
Based on our analysis, vulnerability management teams should prioritize remediation based on the following criteria:
1. Privilege Audit: Identify all accounts with admin profiles and read-write permissions across the affected product suite. Reducing the number of users with these permissions could reduce the internal attack surface.
2. Patch Deployment: Apply vendor-supplied mitigations as specified in Fortinet’s instructions. Given that this vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, immediate patching is recommended for all affected assets.
3. Forensic Triage: Because the vulnerability allows for file deletion and modification, and because forensic triage is required per CISA guidance, defenders should examine system logs for unauthorized CLI activity involving file operations before and after patching.
How to validate remediation
To verify that exposure has been reduced, defenders should move beyond simple version checks:
* Configuration Verification: Confirm that the specific vendor-recommended patch or mitigation is active on each device.
* Privilege Validation: Verify that only essential personnel retain the admin read-write permissions required to trigger the vulnerability.
* Log Analysis: Review audit logs for any evidence of arbitrary file writes or deletions occurring via CLI commands, which would indicate whether the flaw was exploited prior to remediation.
Limits and open questions
While patching addresses the underlying path traversal flaw, residual risk remains if administrative credentials have already been compromised. A patch prevents future exploitation but does not remove files that may have been modified or deleted previously. It is currently unknown if this vulnerability has been utilized in known ransomware campaigns.
Source and editorial note
CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability · Source date: October 16, 2026 · Retrieved October 16, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗