Fortinet FortiOS and FortiProxy: CVE-2025-61624 exploited (KEV)

On 16 October 2026 CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities (KEV) catalog. It is a path traversal vulnerability affecting several Fortinet products: FortiOS, the operating system of FortiGate firewalls, FortiProxy, FortiPAM and FortiSwitchManager. The KEV catalog lists vulnerabilities for which CISA has evidence of active exploitation.

According to the description in the NVD entry, the vulnerability allows an authenticated attacker with an admin profile and at least read-write permissions to write or delete arbitrary files on the system through specific CLI commands.

What happened

The vulnerability is not new: the NVD entry was published on 14 April 2026, referencing Fortinet advisory FG-IR-26-122. What is new is its addition to the KEV catalog, which signals exploitation in real attacks.

CISA listed the vulnerability as “Fortinet Multiple Products Path Traversal Vulnerability” and set 19 October 2026 as the deadline for US federal agencies: three days, a very short window. Use in ransomware campaigns is marked as “unknown”.

The advisory asks organisations to apply mitigations according to the vendor’s instructions, in line with Binding Operational Directive BOD 26-04 on prioritising security updates based on risk and with CISA’s forensics triage requirements. If mitigations are not available, the product should be discontinued. The advisory also asks organisations to assess the internet exposure of each asset.

The catalog gives no details about the observed attacks, the attackers or the victims.

Technical details

• CVE: CVE-2025-61624; the NVD entry was analysed and updated on 16 October 2026.
• Weakness: CWE-22, improper limitation of a pathname to a restricted directory (path traversal).
• Prerequisite: an account with an admin profile and at least read-write permissions.
• Effect: writing or deleting arbitrary files through specific CLI commands.
• Severity: both CVSS 3.1 scores are medium, but they differ on the attack vector.
  • Fortinet assigns 6.0, AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, with a local vector;
  • NVD assigns 6.5, AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, with a network vector.
  • In both cases high privileges are required, and the impact is high on integrity and availability, none on confidentiality.
• Affected versions (NVD description):
  • FortiOS 7.6.0 through 7.6.4 and 7.4.0 through 7.4.9; all versions of the 7.2, 7.0 and 6.4 branches;
  • FortiPAM 1.7.0 and all versions of the 1.0 to 1.6 branches;
  • FortiProxy 7.6.0 through 7.6.4 and 7.4.0 through 7.4.11; all versions of the 7.2 and 7.0 branches;
  • FortiSwitchManager 7.2.0 through 7.2.7 and 7.0.0 through 7.0.6.
• First unaffected versions according to the ranges in the NVD entry: FortiOS 7.4.10 and 7.6.5, FortiPAM 1.7.1, FortiProxy 7.4.12 and 7.6.5, FortiSwitchManager 7.0.7 and 7.2.8. For the branches listed as “all versions”, the entry gives no fixed version within the same branch.
• Other products: the NVD entry also lists Siemens RUGGEDCOM APE1808 firmware, with Siemens advisory SSA-975644.
• References: besides the Fortinet and Siemens advisories, the NVD entry cites a Unit 42 (Palo Alto Networks) analysis of FortiManager CVE-2024-47575 and the PeerStitch malware. The entry does not explain the link with this vulnerability.

Impact for European and Italian companies

The affected products often sit at the heart of the network: firewalls, proxies, privileged access management and switch management. Whoever can write or delete files on these devices can alter their operation and integrity, as the CVSS vectors indicate.

The vulnerability requires an admin account with write permissions: exploitation therefore assumes that the attacker already holds those credentials or equivalent access. The medium score is no reason to lower your guard: CISA has evidence of active exploitation and has set a three-day deadline.

For organisations within the scope of NIS2, the compromise of a firewall or a privileged access management system is an incident to assess for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN. The same applies to healthcare organisations, where these devices protect networks that handle personal and clinical data.

What to do now

1. Take inventory: identify every device running FortiOS, FortiProxy, FortiPAM and FortiSwitchManager, physical and virtual, with its installed version. If you use Siemens RUGGEDCOM APE1808, check advisory SSA-975644.
2. Update: follow Fortinet advisory FG-IR-26-122 for the fixed version of your branch. According to the NVD entry, the first unaffected versions are FortiOS 7.4.10 and 7.6.5, FortiPAM 1.7.1, FortiProxy 7.4.12 and 7.6.5, FortiSwitchManager 7.0.7 and 7.2.8. For branches where all versions are affected, check the migration path in the advisory.
3. If you cannot update, apply the mitigations provided by the vendor. If there are none, CISA says to discontinue the product.
4. Assess exposure, as the CISA advisory asks: check from which networks the devices’ administration interfaces can be reached.
5. Review administrators: as general good practice, given the vulnerability’s prerequisite, review the accounts with an admin profile and write permissions and remove those that are not needed.
6. Look for traces: review the logs of administrative activity and CLI commands for unexpected logins and operations. If you find traces, treat the device as compromised, follow Fortinet’s guidance and assess your notification obligations.

How ARXDOME helps

ARX Sentry collects firewall and other network device logs in a central collector and offers dedicated firewall pages, including firmware status: it helps you see which devices need updating and keep an eye on anomalous logins and activity. ARX Expose shows which services your company exposes on the internet, the products recognised and their known vulnerabilities. With ARX Horizon you can look up vulnerability details from the portal.

Last updated: 16 October 2026