CISA Lists Fortinet CVE-2025-61624, a 6.0-Rated CLI Flaw Patched 185 Days Earlier, as Exploited

CISA added Fortinet's CVE-2025-61624 to its Known Exploited Vulnerabilities catalogue on October 16, 185 days after Fortinet published the advisory on April 14. The flaw is a path traversal in the command-line interface that lets an authenticated administrator write or delete arbitrary files, and Fortinet scores it 6.0.

CISA's alert names the vendor as Fortinet, the product as "Multiple Products" and the flaw as a Path Traversal Vulnerability. It was listed alongside BeyondTrust's CVE-2026-102764, and the alert page itself shows no remediation due date.

What CVE-2025-61624 requires and allows

Fortinet's advisory FG-IR-26-122 classes the flaw as CWE-22, improper limitation of a pathname to a restricted directory. A privileged attacker supplies crafted arguments to existing CLI commands and can write or delete files outside the intended directory.

The vector is AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, which reads as local access, low complexity, high privileges, no user interaction, and high impact on integrity and availability but none on confidentiality. The base score is 6.0 and the temporal score is 5.4. The advisory lists the impact as escalation of privilege.

The score understates one thing and overstates another. It overstates the ease of reaching the bug, because an attacker must already hold an administrator profile. It understates the value of the bug once reached: arbitrary file write and delete on a firewall's own file system is a route from a stolen or low-trust admin account to persistence on the device.

Affected and fixed versions

Fortinet's advisory lists the following. Anything older than the 7.4 line has no fix on its branch and has to move to a fixed release.

Product	Affected	Fix
FortiOS 7.6	7.6.0 to 7.6.4	7.6.5 or later
FortiOS 7.4	7.4.0 to 7.4.9	7.4.10 or later
FortiOS 7.2, 7.0, 6.4	All versions	Migrate to a fixed release
FortiProxy 7.6	7.6.0 to 7.6.4	7.6.5 or later
FortiProxy 7.4	7.4.0 to 7.4.11	7.4.12 or later
FortiPAM 1.7	1.7.0	1.7.1 or later
FortiSwitchManager 7.2	7.2.0 to 7.2.7	7.2.8 or later
FortiSwitchManager 7.0	7.0.0 to 7.0.6	7.0.7 or later

FortiPAM 1.8 is not affected. FortiPAM 1.0 to 1.6 and FortiProxy 7.2 and 7.0 are affected in all versions and have no fixed build on their branch.

What Fortinet says about exploitation

The Fortinet advisory marks the issue "Known Exploited: Yes" and says it was discovered internally. Its timeline shows only the initial publication on April 14, 2026, with no later revision entries, so the page does not say when Fortinet began treating the flaw as exploited. Neither the advisory nor CISA's alert names an actor or describes a victim.

Fortinet lists no workaround. It does offer a virtual patch, FG-VD-59270.0day, in FMWP database update 25.120, as a temporary measure for customers who cannot upgrade at once.

What to do before the next admin login

Upgrade to the fixed build for the branch in the table. Where that is not possible this week, apply the virtual patch and restrict the management interface to a short list of source addresses, because the attack needs a valid administrator session first.

Treat the admin-account audit as part of the fix. Because exploitation presupposes admin access, a device where this flaw was used has already had its administrator credentials or session compromised by some other route. That is an inference from the vector, not a finding in either source. CISA's October catalogue entries have all carried three-day deadlines, and the PAN-OS and Cisco gateway listings from October 14 faced the same clock. The open question is what Fortinet or CISA know about the attackers, and the next revision of FG-IR-26-122 is where that would appear.