CISA Adds Fortinet CVE-2025-61624 to Actively Exploited Vulnerabilities List
CISA added CVE-2025-61624 in Fortinet products to the KEV catalog. The flaw allows a privileged account to write or delete arbitrary files.
Fortinet CVE-2025-61624 was added by the U.S. agency CISA on October 16, 2026, to the Known Exploited Vulnerabilities (KEV) catalog, which tracks vulnerabilities with known exploitation in real-world environments. The path traversal flaw affects FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager.
According to the available description, this is not direct unauthenticated access to the device. The attacker needs an account with an administrator profile and at least read-write privileges. However, through specific CLI commands, the attacker can write or delete arbitrary files.
Fortinet CVE-2025-61624 in the KEV Catalog
Inclusion in KEV means that CISA has evidence of active exploitation of the flaw. However, the agency has not published technical details of these attacks, the identity of the attackers, or the scope of the affected organizations.
It has also not been publicly confirmed whether attackers are primarily targeting devices exposed to the internet or using the flaw as a post-exploitation technique after gaining privileged access. Reliable publicly available exploitation without prior authentication has also not been confirmed.
Affected Products and Attack Conditions
CVE-2025-61624 affects these Fortinet products:
- FortiOS,
- FortiPAM,
- FortiProxy,
- FortiSwitchManager.
Fortinet issued security bulletin FG-IR-26-122 on April 14, 2026. In it, the manufacturer lists security updates or migration procedures according to the specific product branch.
The ability to write or delete arbitrary files increases the impact of compromising an administrator account. In network security and management products, such access could be used for sabotage, establishing persistence, or further movement through the infrastructure.
What Administrators Should Do
Organizations using the affected products should review bulletin FG-IR-26-122 and apply the relevant fix or migration procedure for their product branch. Since exploitation requires an authenticated administrator account with read-write privileges, administrators should also review administrator accounts and configuration changes.
Additional information may come from potential indicators of compromise, forensic guidance, or campaign details from CISA and Fortinet. It will also be important to see whether the manufacturer releases additional fixes for older product branches or recommends migrating them.
Security firms may subsequently clarify the exploitation method and confirm whether the flaw was deployed independently or in combination with other vulnerabilities.
Sources
- CISA Known Exploited Vulnerabilities Catalog – Confirms the addition of CVE-2025-61624 to KEV on October 16, 2026, its known exploitation status, and the required remediation steps.
- Fortinet PSIRT FG-IR-26-122 – The manufacturer’s primary bulletin on the scope of affected products, exploitation conditions, and available fixes or migration procedures.
- Tenable vulnerability plugin 306463 – Independently corroborates the FG-IR-26-122 bulletin designation, affected versions, and the April 2026 fix publication date.
Verified and updated: October 17, 2026 06:19
