{"id":"fortinet-cli-path-traversal-oct-2026","category":"patch","status":"closed","title":"Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager path traversal CVE-2025-61624 exploited","tldr":"Fortinet says CVE-2025-61624, a CLI file write/delete flaw in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, is exploited. It needs a privileged login. Update to FortiOS 7.4.10/7.6.5 or later; older branches have no fix and must migrate.","summary":"Fortinet's advisory FG-IR-26-122, published on 14 April 2026, describes a path traversal flaw (CVE-2025-61624) in the command line of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. A user who already has high privileges can use specially crafted arguments to existing commands to write or delete arbitrary files. Fortinet rates it medium (CVSS 6.0; NVD lists 6.5) and says it found the flaw internally. The advisory is marked as known to be exploited, and CISA listed it as exploited on 16 October 2026. Fortinet gives no detail on the attacks. Fixes exist for FortiOS 7.4 and 7.6, FortiPAM 1.7, FortiProxy 7.4 and 7.6, and FortiSwitchManager 7.0 and 7.2. FortiOS 7.2, 7.0 and 6.4, FortiPAM 1.0 to 1.6, and FortiProxy 7.2 and 7.0 are affected in all versions with no fix; Fortinet tells those customers to move to a fixed release. A virtual patch is available through Fortinet's intrusion prevention database.","action":"Fortinet administrators should upgrade to a fixed release (for example FortiOS 7.4.10 or 7.6.5) and move off unfixed branches using Fortinet's upgrade tool. Until then, apply Fortinet's virtual patch and review who holds admin accounts.","product":"Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager","audience":"work","severity":"medium","patch":"partial","exploited":true,"cves":["CVE-2025-61624"],"tags":["fortinet","fortios","fortipam","fortiproxy","fortiswitchmanager","path-traversal","known-exploited","cisa-kev"],"affected":["FortiOS 7.6.0 to 7.6.4","FortiOS 7.4.0 to 7.4.9","FortiOS 7.2, 7.0 and 6.4 (all versions)","FortiPAM 1.7.0","FortiPAM 1.0 to 1.6 (all versions)","FortiProxy 7.6.0 to 7.6.4","FortiProxy 7.4.0 to 7.4.11","FortiProxy 7.2 and 7.0 (all versions)","FortiSwitchManager 7.2.0 to 7.2.7","FortiSwitchManager 7.0.0 to 7.0.6"],"fixed":["FortiOS 7.6.5 or later","FortiOS 7.4.10 or later","FortiPAM 1.7.1 or later","FortiProxy 7.6.5 or later","FortiProxy 7.4.12 or later","FortiSwitchManager 7.2.8 or later","FortiSwitchManager 7.0.7 or later"],"matches":[],"sources":[{"kind":"advisory","title":"Path Traversal in CLI (FG-IR-26-122)","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-122","by":"Fortinet PSIRT","date":"2026-04-14"}],"started":"2026-10-16","closed":"2026-10-16","created":"2026-11-03T21:55:16.088Z","updated":"2026-11-03T21:55:16.088Z","cve_notes":[{"cve":"CVE-2025-61624","name":"Path traversal in Fortinet CLI (FortiOS, FortiPAM)","what":"A path traversal flaw in the command line of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager that lets a logged-in, high-privilege user write or delete files anywhere on the device using crafted command arguments.","severity":"medium","cvss":6}],"timeline":[{"at":"2026-04-14","added":"2026-11-03T21:54:15.158Z","kind":"wider-attacks","text":"The advisory is marked 'Known Exploited: Yes' and offers a virtual patch (FG-VD-59270.0day) in FMWP database update 25.120. It gives no detail on who is exploiting the flaw or how widely. CISA listed the flaw as exploited on 2026-10-16, according to the report that prompted this record; as of the advisory's last listed revision no later changes are shown.","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-122","by":"Fortinet PSIRT","patch":"partial"},{"at":"2026-04-14","added":"2026-11-03T21:54:15.158Z","kind":"disclosed","text":"Fortinet published advisory FG-IR-26-122 for CVE-2025-61624, a path traversal flaw in the command line of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. It listed fixes for FortiOS 7.4 and 7.6, FortiPAM 1.7, FortiProxy 7.4 and 7.6, and FortiSwitchManager 7.0 and 7.2, and said older branches must migrate to a fixed release.","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-122","by":"Fortinet PSIRT","patch":"partial"}],"url":"https://hard.fyi/live/fortinet-cli-path-traversal-oct-2026/","json":"https://hard.fyi/api/live?id=fortinet-cli-path-traversal-oct-2026"}