CVE-2025-61624: Fortinet CLI path traversal, actively exploited (FG-IR-26-122)
Published 26/10/2026 10:54
Timeline
3 events over 10 d
- 16/10/2026ConfirmedCISA Known Exploited Vulnerabilities+0 min
- 16/10/2026ExploitedCISA Known Exploited Vulnerabilities+10 d
- 26/10/2026 10:54Published on WatchtowerPro CISO
In short
CVE-2025-61624 is a path traversal flaw in the command line of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. An attacker with an admin profile and at least read-write permissions can write or delete arbitrary files. CISA lists it as exploited (16/10/2026), so affected devices should be updated and checked for compromise. Shodan estimates about 373,803 internet-facing Fortinet FortiGate (FortiOS) servers worldwide, 63,127 of them in the EU (26/10/2026); how many run an affected version is not yet known.
Affected versions
- FortiOS 7.6.0-7.6.4, 7.4.0-7.4.9, and all of 7.2 (up to 7.2.13), 7.0 (up to 7.0.19) and 6.4 (up to 6.4.16)
- FortiProxy 7.6.0-7.6.4, 7.4.0-7.4.11, and all of 7.2 and 7.0
- FortiPAM 1.0 to 1.7.0 (all)
- FortiSwitchManager 7.2.0-7.2.7 and 7.0.0-7.0.6
- The attacker needs an authenticated admin profile with at least read-write permissions.
- The CISA catalog entry also lists FortiPAM, FortiProxy and FortiSwitchManager, not only FortiOS.
What to do now
- Update to a fixed version: FortiOS 7.6.5 or 7.4.10; FortiProxy 7.6.5 or 7.4.12; FortiPAM 1.7.1; FortiSwitchManager 7.2.8 or 7.0.7.
- Customers on FortiOS 7.2, 7.0 or 6.4, or FortiProxy 7.2 or 7.0, need to move to a newer branch: FortiOS 7.4.10 or later / 7.6.5 or later, FortiProxy 7.4.12 or later / 7.6.5 or later.
- Fortinet's own interim measures are not yet known because its advisory could not be read. Check advisory FG-IR-26-122 for an official workaround.
- Because exploitation is confirmed, check devices that were exposed before patching for compromise. CISA expects forensic triage under BOD 26-04.
- Until the update is installed, general hardening reduces exposure but does not make a device safe: limit admin access to trusted internal addresses, audit admin accounts and reduce read-write rights. These are not vendor-stated measures.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 4 sources with their dates. And technology matching: which of your systems run Fortinet FortiGate (FortiOS), at which version, fixed or not - and what each one needs.
Main sources
Known exploited: Fortinet Multiple Products - Fortinet Multiple Products Path Traversal Vulnerability Vendor · NVD-CVE-2025-61624 - National Vulnerability Database Research · CISA Adds Two Known Exploited Vulnerabilities to Catalog Research
Data: Shodan - Fortinet FortiGate (FortiOS) (estimate, 26/10/2026)