CVE-2025-61624: Fortinet CLI Path Traversal
Active exploitation confirmed in CISA KEV.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:HActive exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-10-16. Federal agencies must patch by 2026-10-19.
TL;DR - CVE-2025-61624 is an authenticated Fortinet CLI path-traversal flaw that can enable arbitrary file creation, modification, or deletion. - Affected product families include FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. - CISA lists the vulnerability as known exploited. Patch exposed appliances urgently and investigate administrator, CLI, configuration, and file activity.
What Happened?
CVE-2025-61624 is a path-traversal vulnerability in the command-line interpreter of multiple Fortinet products. An attacker who already has an administrator profile with read-write permissions can provide specially crafted arguments to existing CLI commands. Successful exploitation may allow arbitrary file creation, modification, or deletion on the appliance.
This is not an unauthenticated initial-access vulnerability. It does, however, increase the consequences of a compromised privileged account. An attacker with suitable administrative credentials may use the flaw to tamper with appliance files, disrupt operations, establish persistence, or support later compromise.
For background on security monitoring roles and controls, see what is SOC?.
| Field | Details |
|---|---|
| CVE | CVE-2025-61624 |
| CWE | CWE-22, Improper Limitation of a Pathname to a Restricted Directory |
| CVSS | 6.0, Medium |
| Attack vector | Network-based administrative access; verify the authoritative vector in the current NVD or Fortinet record |
| Authentication and privileges | Authenticated attacker with a sufficiently privileged administrator profile and read-write permissions |
| User interaction | Not required, according to the reported vector data |
| Patch available | Yes; fixed releases are available or identified for affected product branches |
| Exploitation status | Confirmed in the wild; listed in the CISA Known Exploited Vulnerabilities catalog |
| CISA KEV date | October 16, 2026 |
| CISA due date | October 19, 2026 |
The NVD record provides a CVSS base score of 6.0, but the retrieved compact record did not expose the vector. A secondary indexed technical reference reports:
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Treat that vector as a working reference only and verify the authoritative value before using it in formal risk calculations.
Analyst’s Take: The authentication requirement limits who can exploit this flaw, but it also makes administrative access the key control point. Because exploitation is confirmed and the affected products commonly sit in privileged network positions, exposed management interfaces and administrator-account activity should be immediate response priorities.
Root Cause
The underlying defect is improper pathname restriction in the products’ command-line interpreter. A vulnerable command accepts attacker-controlled arguments and does not adequately prevent path traversal outside the intended directory or file context. By manipulating those arguments, a privileged user may reach files that the command should not permit them to modify or remove.
The vulnerability is primarily an integrity and availability issue. The available technical description does not indicate direct confidentiality impact, and the reported CVSS components assign confidentiality impact as none. File modification and deletion on a security appliance can still cause serious secondary effects, including configuration corruption, service disruption, altered scripts or supporting files, and interference with forensic evidence.
The required privilege level matters. Exploitation depends on an attacker possessing an administrator account with read-write permissions. Internet-facing management interfaces, reused credentials, stolen administrator sessions, weak MFA coverage, and excessive administrator permissions can all make that precondition realistic.
Affected Products and Fixed Releases
Affected product families include FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. The version information below combines broad affected ranges in the NVD description with more specific branch ranges indexed in NVD configuration data. Fortinet’s advisory remains authoritative for branch support and fixed releases.
| Product | Affected versions reported | Fixed release information |
|---|---|---|
| FortiOS | 7.6.0–7.6.4; 7.4.0–7.4.9; and reported versions in the 7.2, 7.0, and 6.4 branches. Indexed ranges include 7.2.0–7.2.13, 7.0.0–7.0.19, and 6.4.0–6.4.16. | Upgrade to the Fortinet-designated fixed release for the installed branch. Indexed advisory data identifies 7.6.5 and 7.4.10, with corresponding fixed releases for affected 7.2, 7.0, and 6.4 branches. |
| FortiPAM | 1.7.0 and reported versions in branches 1.6 through 1.0. Indexed ranges include 1.6.0–1.6.2, 1.5.0–1.5.1, 1.4.0–1.4.3, and 1.3.0–1.3.1. | Upgrade to 1.7.1 or the corresponding fixed release for the installed supported branch. |
| FortiProxy | 7.6.0–7.6.4; 7.4.0–7.4.11; and reported versions in 7.2 and 7.0. Indexed ranges include 7.2.0–7.2.16 and 7.0.0–7.0.23. | Upgrade to 7.6.5, 7.4.12, or the corresponding fixed release for the installed branch. |
| FortiSwitchManager | 7.2.0–7.2.7 and 7.0.0–7.0.6 | Upgrade to 7.2.8 or 7.0.7, as applicable. |
Inventory standalone appliances, centrally managed devices, virtual appliances, and dormant or disaster-recovery instances. Include devices whose management interfaces are restricted by firewall policy: exploitation may still occur through an internal compromise, a stolen administrative session, or a trusted management host.
Prioritize devices with:
- Internet-exposed administrative interfaces
- Administrator accounts without phishing-resistant MFA
- Broad read-write profiles
- Unexpected configuration, CLI, or file activity
- Unsupported branches or products without a vendor-approved fix
If a product branch is unsupported or no vendor-approved fix is available, follow Fortinet and CISA guidance rather than assuming that access restriction alone removes the risk.
Why the CVSS Score Is Medium
The reported CVSS base score is 6.0, classified as Medium. The score reflects a vulnerability that can cause substantial integrity and availability harm but requires a highly privileged authenticated account. The commonly indexed vector is:
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
The components describe a network-reachable attack (AV:N) with low attack complexity (AC:L). No additional user interaction is required (UI:N). The high privileges-required value (PR:H) is the principal factor limiting the base score: the attacker must already have a sufficiently privileged administrative identity.
The impact components indicate no direct confidentiality impact (C:N), but high integrity (I:H) and availability (A:H) impact. That is consistent with the ability to write or delete arbitrary files. Scope is unchanged (S:U), meaning the described impact remains within the vulnerable security authority.
CVSS is not a complete operational risk rating. CISA KEV status, internet exposure, administrator-account compromise, asset criticality, and evidence of exploitation can make this Medium-rated vulnerability an emergency in a particular environment. Use the score for prioritization context, not as a reason to defer remediation.
Has CVE-2025-61624 Been Exploited?
Yes. CVE-2025-61624 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming exploitation in the wild. Fortinet’s indexed PSIRT advisory also marks the issue as known exploited. The CISA entry was added on October 16, 2026, with an October 19, 2026 remediation due date.
CISA’s record lists known ransomware campaign use as unknown. The catalog does not attribute the activity to a known ransomware campaign; it does not mean exploitation is unconfirmed or benign. Investigate affected appliances even when there is no evidence of ransomware activity.
No verified public proof-of-concept repository was identified in the supplied primary-source material. Secondary reporting indicates that no public PoC was found. That distinction does not change patch priority because exploitation has already been confirmed.
The NVD references a Unit 42 report concerning Fortinet compromise activity and PEERSTITCH malware, but defenders should not infer that every such incident resulted from CVE-2025-61624 without validating the complete report and attack path.
Detection Guidance
Begin with asset and version verification, then review privileged administrative activity. Export configuration and audit data before making major changes where possible, because an attacker able to delete or modify files may also attempt to remove local evidence.
Review:
- Administrator logins
- CLI command history
- Configuration changes
- Authentication failures
- Account creation and privilege changes
- File-integrity telemetry
- Unexpected outbound connections from the management plane
- Logins from unusual source addresses or outside normal maintenance windows
- Administrator accounts using CLI access when they normally use only the web console
Look for CLI arguments containing traversal sequences or unexpected absolute paths. Fortinet log field names and command-audit formats vary by product and release, so validate searches against your parser.
SIEM Search Pattern
A starting point for normalized administrative and CLI logs is:
(event.category:authentication OR event.category:configuration OR event.action:cli)
AND (user.roles:administrator OR user.privileges:read-write)
AND (
process.command_line:*../* OR
process.command_line:*..\\* OR
process.command_line:"/*" OR
process.command_line:*delete* OR
process.command_line:*write*
)
If raw logs are not normalized, search text exports for traversal and administrative indicators:
grep -Eini \
'(\.\./|\.\.\\\\|administrator|admin|config|cli|delete|write|file)' \
fortinet-*.log
These patterns are triage aids, not signatures for confirmed exploitation. Legitimate maintenance commands may contain file-related terms, and some Fortinet logging configurations may not record full CLI arguments.
Correlate candidate events with:
- Source IP address
- Administrator identity
- Device and serial number
- Login session
- Change ticket
- Subsequent file or configuration changes
Compare current configurations with known-good backups, examine unexpected file timestamps where the platform exposes them, and review outbound connections from the management plane. The absence of a matching log line does not prove that the appliance was not exploited, particularly if audit logging was disabled, rotated, or tampered with.
Remediation and Patching
Upgrade each affected product to the vendor-designated fixed release for its installed branch. The indexed fixed-version information identifies:
- FortiOS 7.6.5 and 7.4.10
- FortiPAM 1.7.1
- FortiProxy 7.6.5 and 7.4.12
- FortiSwitchManager 7.2.8 and 7.0.7
Corresponding fixed releases exist for other affected branches. Select the exact target from Fortinet’s current advisory and the appliance’s supported upgrade path.
Do not jump between branches solely because a version number appears newer. Confirm hardware or virtual-appliance compatibility, back up configuration and certificates, review release notes, and test management access after the upgrade.
If the device is suspected of compromise, preserve relevant evidence and coordinate forensic triage before rebuilding or restoring files that may be needed to establish scope.
Safe Upgrade Sequence
For FortiOS, use the local CLI or FortiManager workflow appropriate to the appliance and release. A generic FortiOS upgrade command pattern is:
execute restore image tftp <image-filename> <tftp-server-ip>
The exact command and image-transfer method depend on the platform, firmware, and approved change procedure. Do not execute this example without confirming the supported Fortinet upgrade workflow for the device.
For centrally managed estates, use the supported FortiManager or FortiCloud firmware-management workflow and verify that the selected image is the fixed release for the device’s branch.
A safe operational sequence is:
# Illustrative change-management sequence
1. Record product, current version, serial number, and HA/cluster role.
2. Export and protect a known-good configuration backup.
3. Confirm the Fortinet-approved target release for that branch.
4. Stage the image through the approved management channel.
5. Upgrade the device or HA pair during an approved window.
6. Verify the running version, HA state, routing, VPNs, policies, and logging.
7. Re-enable or validate centralized audit collection.
Until patching is complete:
- Restrict administrative interfaces to trusted management networks or VPNs.
- Remove unnecessary administrator accounts.
- Enforce MFA.
- Reduce read-write permissions to the minimum required.
- Monitor administrative logins and configuration changes.
- Preserve relevant logs and configuration backups.
These are compensating controls, not substitutes for upgrading.
If no supported fixed release or effective vendor mitigation is available, isolate the management interface, remove the appliance from untrusted network paths where feasible, and follow CISA’s direction to discontinue use when mitigation is unavailable.
For any device with evidence of unauthorized administrative activity:
- Preserve available evidence.
- Rotate administrator credentials and API tokens from a trusted host.
- Review downstream systems for related access.
- Investigate configuration and file changes.
- Coordinate incident-response and forensic triage.
- Rebuild or restore the appliance when integrity cannot be established.
Patching alone is not enough when administrator or file activity looks suspicious.
Recommended Response
First, identify every affected appliance and determine whether its management interface or administrator accounts were exposed. Restrict that access, preserve available evidence, and move each device to the Fortinet-designated fixed release for its branch.
Because exploitation is confirmed, treat CVE-2025-61624 as an urgent remediation and investigation priority—even though its CVSS score is Medium.
References
-
NIST National Vulnerability Database: CVE-2025-61624
https://nvd.nist.gov/vuln/detail/CVE-2025-61624 -
Fortinet PSIRT advisory FG-IR-26-122
https://fortiguard.fortinet.com/psirt/FG-IR-26-122 -
CISA Known Exploited Vulnerabilities catalog: CVE-2025-61624
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61624 -
Siemens ProductCERT advisory
https://cert-portal.siemens.com/productcert/html/ssa-975644.html -
Unit 42 report referenced by NVD
https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/#post-188095-_guyq53ar8k05
Fortinet’s live PSIRT advisory should remain the authoritative source for exact fixed releases, supported upgrade paths, and product-specific workarounds. Because the supplied NVD response did not expose the full CVSS vector and the retrieved Fortinet page was partially represented by indexed advisory data, validate those details directly before final change approval.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.