CISA has added CVE-2025-61624, a path traversal flaw in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, to its Known Exploited Vulnerabilities catalog, which confirms it is being exploited in the wild.
What Is It
CVE-2025-61624 is an "Improper Limitation of a Pathname to a Restricted Directory" vulnerability (CWE-22). According to NVD, an authenticated attacker who has an admin profile with at least read-write permissions can use specific CLI commands to write or delete arbitrary files.
NVD scores it CVSS 3.1 6.0 (MEDIUM) with vector AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H. This means local access and high privileges are required. There is no impact on confidentiality, but the impact on integrity and availability is high.
Why It Matters
- Active exploitation confirmed: CISA added the CVE to the KEV catalog on 2026-10-16.
- Short deadline: The KEV due date is 2026-10-19, three days after the listing.
- Forensic triage flagged: The KEV entry marks forensic triage as "Yes." It points to CISA's Forensics Triage Requirements under BOD 26-04, so agencies are expected to investigate as well as patch.
- Ransomware use: Listed as "Unknown."
Exploitation requires high-privilege admin access. Even so, being able to write or delete arbitrary files on security appliances is a serious integrity risk for perimeter and access-management infrastructure.
What's Vulnerable
Per the NVD description:
- FortiOS: 7.6.0–7.6.4, 7.4.0–7.4.9, and all versions of 7.2, 7.0 and 6.4
- FortiPAM: 1.7.0, and all versions of 1.6, 1.5, 1.4, 1.3, 1.2, 1.1 and 1.0
- FortiProxy: 7.6.0–7.6.4, 7.4.0–7.4.11, and all versions of 7.2 and 7.0
- FortiSwitchManager: 7.2.0–7.2.7 and 7.0.0–7.0.6
NVD's CPE data also lists the Siemens RUGGEDCOM APE1808 and its firmware. Siemens has published an advisory (SSA-975644).
Patch Status
The NVD entry and the KEV listing do not name fixed versions. Fortinet PSIRT advisory FG-IR-26-122 has the fixed releases and upgrade paths.
CISA's required action:
- Apply mitigations according to vendor instructions, in line with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements.
- Follow the applicable BOD 26-04 guidance for cloud services, or stop using the product if mitigations are unavailable.
- Assess each asset's internet exposure and follow the BOD 26-04 patching guidelines.
Branches listed as affected in "all versions" (FortiOS 7.2/7.0/6.4, FortiProxy 7.2/7.0, FortiPAM 1.0–1.6) may require migrating to a supported branch. Confirm this against the vendor advisory.