ZeroDayAlert

CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

Fortinet Multiple Products Added to KEV 2026-10-16 Federal due 2026-10-19 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

This path traversal vulnerability affects FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. The vulnerability requires an authenticated attacker with admin profile and read-write permissions to exploit it through specific CLI commands. If you operate any of these Fortinet products in your environment, you should assess your exposure immediately.

How to check whether this touches you

  • Inventory your Fortinet deployments: identify which products (FortiOS, FortiPAM, FortiProxy, FortiSwitchManager) and in which roles (perimeter, internal access control, switch management, privileged access management).
  • Confirm which of your systems allow CLI access and who holds admin profiles with read-write permissions—focus on service accounts, automation systems, and named administrative users.
  • Collect the running version numbers from each affected instance; version identifiers alone do not prove whether a patch has been applied, as vendors may backport fixes, so cross-reference with your patch log and Fortinet's advisory.
  • Check whether CLI access is exposed to untrusted networks (including via jump hosts, bastion services, or forwarded ports); local-only access reduces but does not eliminate risk if internal staff are compromised.

What to do

  1. Obtain Fortinet's official security advisory for CVE-2025-61624 and confirm which versions of each product contain mitigations or patches.
  2. If you cannot patch immediately, restrict CLI access to the smallest possible set of trusted administrative systems and networks; disable CLI access for service accounts that do not require it.
  3. Review and strengthen access controls for admin profiles: audit which accounts hold read-write permissions and remove unnecessary privileges.
  4. Enable and review all CLI command audit logs, specifically filtering for file write and delete operations (write, delete, and path-related commands); retain these logs for forensic investigation.
  5. If the product is exposed to the internet or untrusted networks, evaluate discontinuation or offline operation until mitigations are in place.
  6. Follow CISA BOD 26-04 guidance for your organisation's risk tier and prioritise patching or mitigation accordingly.

If you find you were exposed

Check CLI audit logs from at least the past six months (or as far back as your retention allows) for unauthenticated or anomalous admin access, unusual file operations, or path traversal patterns. Exploitation typically occurs before public disclosure, so retrospective log analysis is your primary tool for detecting whether this vulnerability was used against you. If logs have been deleted or do not cover the period, document the log retention gap and assess whether system backups or endpoint detection tools can fill the gap.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2025-61624 is being exploited. It cannot tell you whether Multiple Products is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →