CVE-2025-61624: Fortinet FortiOS/FortiProxy/FortiPAM CLI Path Traversal (KEV)

CVE-2025-61624 is a path traversal in the CLI of Fortinet FortiOS, FortiProxy, FortiPAM and FortiSwitchManager that lets an authenticated administrator with read-write permissions write or delete arbitrary files via crafted CLI arguments; Fortinet's own advisory marks it as known exploited and CISA added it to KEV in October 2026.

CVE-2025-61624 is an improper limitation of a pathname to a restricted directory (CWE-22) in the command line interpreter of Fortinet FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. NVD's description states the flaw "may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands" (NVD).

NVD lists the CVE as "Analyzed" with an NVD-published CVSS v3.1 base score of 6.5 (medium), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H; Fortinet's own CNA submission scores it slightly lower at 6.0, vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H — the two sources disagree on attack vector (NVD treats it as network-reachable, Fortinet as local) but agree the impact requires an already-authenticated, privileged admin session (NVD).

Fortinet's PSIRT advisory FG-IR-26-122 lists the affected builds above, states the status as "Known Exploited: Yes," and offers a virtual patch — FortiGuard IPS signature "FG-VD-59270.0day," available from FMWP database update 25.120 — for devices pending upgrade (Fortinet PSIRT Advisory FG-IR-26-122).

CISA added CVE-2025-61624 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-16, with a required-action due date of 2026-10-19 and ransomware campaign use recorded as "Unknown" (CISA KEV).

As of 2026-10-26, FIRST scores the probability of exploitation at 0.0134 (71.162th percentile) (FIRST EPSS).

Because this is a confirmed, actively exploited file-tampering path that only requires an already-authenticated admin session, operators of affected FortiOS, FortiProxy, FortiPAM or FortiSwitchManager builds should upgrade to the fixed versions and apply the FMWP virtual patch in the interim, and review admin-account hygiene given the CLI-level write/delete capability this flaw grants.

• Path traversal in the Fortinet CLI lets an authenticated admin with read-write permissions write or delete arbitrary files via specific CLI commands. — NVD
• NVD-published CVSS v3.1 base score is 6.5 (medium), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H; Fortinet's own CNA score is 6.0 with a local attack vector, status Analyzed. — NVD
• Affects FortiOS 6.4.0-6.4.16/7.0.0-7.0.19/7.2.x/7.4.0-7.4.9 (fixed 7.4.10)/7.6.0-7.6.4 (fixed 7.6.5); FortiProxy, FortiPAM 1.0.0-1.7.0 (fixed 1.7.1), FortiSwitchManager similarly; status 'Known Exploited: Yes'; virtual patch FG-VD-59270.0day available via FMWP update 25.120. — Fortinet PSIRT Advisory FG-IR-26-122
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-16, due date 2026-10-19, ransomware campaign use Unknown. — CISA KEV
• EPSS score is 0.0134 (71.162th percentile) as of 2026-10-26. — FIRST EPSS