Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager path traversal CVE-2025-61624 exploited
Fortinet says CVE-2025-61624, a CLI file write/delete flaw in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, is exploited. It needs a privileged login. Update to FortiOS 7.4.10/7.6.5 or later; older branches have no fix and must migrate.
Fortinet administrators should upgrade to a fixed release (for example FortiOS 7.4.10 or 7.6.5) and move off unfixed branches using Fortinet's upgrade tool. Until then, apply Fortinet's virtual patch and review who holds admin accounts.
What’s happening
Fortinet's advisory FG-IR-26-122, published on 14 April 2026, describes a path traversal flaw (CVE-2025-61624) in the command line of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. A user who already has high privileges can use specially crafted arguments to existing commands to write or delete arbitrary files. Fortinet rates it medium (CVSS 6.0; NVD lists 6.5) and says it found the flaw internally. The advisory is marked as known to be exploited, and CISA listed it as exploited on 16 October 2026. Fortinet gives no detail on the attacks. Fixes exist for FortiOS 7.4 and 7.6, FortiPAM 1.7, FortiProxy 7.4 and 7.6, and FortiSwitchManager 7.0 and 7.2. FortiOS 7.2, 7.0 and 6.4, FortiPAM 1.0 to 1.6, and FortiProxy 7.2 and 7.0 are affected in all versions with no fix; Fortinet tells those customers to move to a fixed release. A virtual patch is available through Fortinet's intrusion prevention database.
- What
- Flaw
- Affects
- Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager
- Affected
- FortiOS 7.6.0 to 7.6.4
FortiOS 7.4.0 to 7.4.9
FortiOS 7.2, 7.0 and 6.4 (all versions)
FortiPAM 1.7.0
FortiPAM 1.0 to 1.6 (all versions)
FortiProxy 7.6.0 to 7.6.4
FortiProxy 7.4.0 to 7.4.11
FortiProxy 7.2 and 7.0 (all versions)
FortiSwitchManager 7.2.0 to 7.2.7
FortiSwitchManager 7.0.0 to 7.0.6 - Fixed in
- FortiOS 7.6.5 or later
FortiOS 7.4.10 or later
FortiPAM 1.7.1 or later
FortiProxy 7.6.5 or later
FortiProxy 7.4.12 or later
FortiSwitchManager 7.2.8 or later
FortiSwitchManager 7.0.7 or later - Since
- 16 Oct 2026
- Closed
- 16 Oct 2026
Timeline
- Wider attacksPartly fixed
The advisory is marked 'Known Exploited: Yes' and offers a virtual patch (FG-VD-59270.0day) in FMWP database update 25.120. It gives no detail on who is exploiting the flaw or how widely. CISA listed the flaw as exploited on 2026-10-16, according to the report that prompted this record; as of the advisory's last listed revision no later changes are shown.
- Made publicPartly fixed
Fortinet published advisory FG-IR-26-122 for CVE-2025-61624, a path traversal flaw in the command line of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. It listed fixes for FortiOS 7.4 and 7.6, FortiPAM 1.7, FortiProxy 7.4 and 7.6, and FortiSwitchManager 7.0 and 7.2, and said older branches must migrate to a fixed release.
Sources
- Path Traversal in CLI (FG-IR-26-122)Fortinet PSIRT · 14 Apr 2026