FortiOS path traversal, exploited in the wild (CVE-2025-61624)

Actively exploited in the wild - CVE-2025-61624 is a medium-severity path traversal flaw in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, and all older FortiOS branches, plus FortiProxy, FortiPAM and FortiSwitchManager, that lets an authenticated admin write or delete arbitrary files on the underlying system via crafted CLI commands. Fortinet has released fixed builds; upgrade to FortiOS 7.6.5 or 7.4.10 (or the corresponding FortiProxy and FortiPAM fixes) as soon as possible.

Overview

CVE-2025-61624 is a path traversal vulnerability (CWE-22) in Fortinet’s FortiOS, FortiProxy, FortiPAM and FortiSwitchManager products. The flaw allows an attacker who already holds an administrator profile with at least read-write permissions to escape the intended restricted directory and write to, or delete, files anywhere on the device’s filesystem using specific CLI commands.

Exploitation requires a valid high-privilege admin account, which is why the CVSS score is 6.5 (MEDIUM) with a LOCAL attack vector and HIGH privileges required. However, CISA has added this CVE to its Known Exploited Vulnerabilities catalog, confirming real-world attacks. The typical attack chain is credential theft or a phishing campaign against a Fortinet administrator, followed by the abuse of the CLI to plant files or destroy configuration and log data - a common pattern for persistence and covering tracks after initial access.

The affected versions are broad: FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, and every release in the 7.2, 7.0 and 6.4 trains; FortiProxy 7.6.0 through 7.6.4, 7.4.0 through 7.4.11, and older branches; FortiPAM 1.7.0 and all 1.6 and earlier versions; and FortiSwitchManager 7.2.0 through 7.2.7 and 7.0.0 through 7.0.6.

Impact

An attacker with admin credentials can overwrite system files or delete critical data, potentially causing service disruption, configuration tampering or a foothold that survives a reboot. Because the flaw is file-system level, it can also be chained with other techniques to weaken logging or persistence detection. The EPSS score is only 0.6% for the next 30 days, so mass scanning is unlikely - but targeted intrusions against exposed Fortinet management interfaces are confirmed.

Remediation and Mitigation

• Update FortiOS 7.6.x to 7.6.5 or later, FortiOS 7.4.x to 7.4.10 or later, and apply the current fixed builds for FortiProxy, FortiPAM and FortiSwitchManager. For older branches (7.2, 7.0, 6.4 and FortiPAM 1.6 and below), Fortinet recommends migrating to a supported release.
• Restrict admin access: never expose the management interface to the internet, enforce MFA, and use least-privilege admin profiles.
• Audit admin accounts for unexpected changes and review CLI command logs for suspicious file operations.
• Review Fortinet’s PSIRT advisory for the exact fixed build per product line.

Security Insight

CVE-2025-61624 is a textbook example of the post-compromise risk that follows a stolen admin credential. The flaw does not grant access by itself - it amplifies an attacker who is already inside, turning read-write CLI access into filesystem control. That mirrors the pattern seen with FortiMail zero-day CVE-2026-104286 exploited, where Fortinet products again became the initial or escalation vector in targeted campaigns. For defenders, the lesson is that administrative access on network security appliances is now a first-class attack surface, and MFA and interface isolation matter as much as patch cadence. See also our weekly threat roundup and the Apple CoreGraphics zero-day fix for context on how quickly exploited CVEs accumulate.

Further Reading

• FortiMail zero-day CVE-2026-104286 exploited
• Apple fixes iOS CoreGraphics zero-day CVE-2026-86950
• Weekly Threat Roundup: Nx Console Supply Chain Attack (May 25-31)
• All Medium Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs