> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2025-61624 Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability - URL: https://f4n6.co.uk/security-feed/cve-2025-61624-fortinet-multiple-products-fortinet-multiple-products-path-traversal-vulnerability/ - Published: 2026-10-16T19:24:48.000Z - Updated: 2026-10-16T19:24:48.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2025-61624 ## 1\. Executive summary CVE-2025-61624 is a path traversal flaw (CWE-22) in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager that lets an authenticated attacker holding an admin profile with at least read-write permissions write or delete arbitrary files through specific CLI commands. NVD scores it CVSS 6.0 MEDIUM, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-16, which means exploitation has been observed in the wild. The EPSS score is 1%, so mass opportunistic scanning is unlikely; the risk is concentrated in environments where an attacker already holds a privileged administrative session. For EMEA financial services the exposure is real wherever Fortinet management planes are reachable from untrusted networks or where admin credentials are shared, and the file-write primitive is the concern rather than the CVSS number. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | CVE-2025-61624 is in CISA KEV, so exploitation has been observed; an entity running an affected Fortinet product must be able to detect and manage the resulting ICT-related incident. | The incident management process must cover compromise of the Fortinet management plane, not just the network edge it protects. | | DORA Art. 18 | The flaw allows an authenticated admin to write or delete arbitrary files, which is a confidentiality and integrity event on a security control, not a routine outage. | Classification must account for integrity loss on a control device; a file-write on a firewall or proxy is not a benign availability incident. | | NIS2 Art. 21(2)(d) | FortiOS, FortiProxy and FortiSwitchManager are commonly deployed as supply-chain security controls at the network boundary. | Entities relying on these products for supply-chain security measures must treat compromise of the device as a failure of that measure and reassess the control. | DORA Art. 19 and NIS2 Art. 23 are not listed as engaged here because whether a given incident is major, and therefore reportable, depends on facts this item does not contain. Apply your own classification under Art. 18 first. ## 3\. Technical analysis & attack chain The vulnerability is a path traversal (CWE-22) reachable through specific CLI commands. The attacker must already be authenticated with an admin profile and at least read-write permissions. That precondition is the whole story: this is not a pre-auth remote exploit, and the EPSS score of 1% is consistent with that. Confirmed steps, from the NVD record: 1. Attacker obtains an authenticated session with an admin profile that carries at least read-write permissions. 2. Attacker issues specific CLI commands that traverse out of the intended path. 3. The traversal allows writing or deleting arbitrary files on the underlying system. The NVD record does not name the affected versions, the exact CLI commands, the traversal sequence, or the file paths reachable. It also does not state whether the file write can reach a location that yields code execution, persistence or credential theft. Treat those as open questions and get them from Fortinet's own advisory before you plan remediation, because the difference between "arbitrary file delete" and "write into a path the device executes" changes the containment decision. The KEV listing means exploitation has been observed, but the record does not say by whom, against which sectors, or with what post-exploitation behaviour. No actor is named and no MITRE ATT&CK profile is supplied, so any attribution would be speculation. Do not attach a campaign name to this CVE on the basis of the KEV entry alone. Context from adjacent Fortinet KEV entries is worth noting because it shapes how you triage. CVE-2026-104286 (FortiMail) is an unauthenticated path traversal with a NULL byte neutralisation flaw that writes arbitrary files via crafted HTTP or HTTPS requests, and SecurityWeek describes it as an exploited zero-day. CVE-2026-25089 (FortiSandbox) is an unauthenticated OS command injection via crafted HTTP requests. CVE-2025-25249 is a heap-based buffer overflow in FortiOS, FortiSwitchManager and FortiSASE reachable with specially crafted packets. CVE-2025-68686 (FortiOS) is an exposure of sensitive information that bypasses the patch for a symbolic link persistency mechanism seen in post-exploit cases, and it explicitly requires the attacker to have compromised the product first via another vulnerability at filesystem level. That last one matters here: a path traversal that writes files is exactly the kind of primitive that could precede the symlink persistency technique CVE-2025-68686 describes, so a FortiOS host with CVE-2025-61624 exposure should be checked for the persistence pattern as well. That link is our inference from the two records, not a claim either record makes. ## 4\. Mitigation & containment P1, within 24 hours: - Inventory every FortiOS, FortiPAM, FortiProxy and FortiSwitchManager instance, including management interfaces, and confirm which are reachable from untrusted networks. The KEV due date is 2026-10-19. - Apply the vendor fix. The NVD record directs you to apply mitigations in accordance with vendor instructions; it does not name a fixed version, so take the version from Fortinet's advisory for each product line rather than from this note. - Restrict management access. If the management plane is internet-facing, move it behind a management network or VPN now. The exploit needs an authenticated admin session, and reducing who can reach the login reduces the population of sessions an attacker can obtain. - Audit admin accounts with read-write profiles on affected devices. Remove or downgrade any that do not need write access, and rotate credentials for the rest. Shared admin accounts defeat the "authenticated attacker" precondition as a control. - Where a fix is not yet available for a given product, follow the BOD 26-04 guidance in the NVD record: apply vendor mitigations, or discontinue use of the product. P2, within 72 hours: - Hunt for file writes and deletions on affected devices in the window since the KEV addition. The record does not give file paths, so baseline against known-good configuration and filesystem state where you have it. - Check FortiOS hosts for the symbolic link persistency pattern described in CVE-2025-68686, since a file-write primitive is a plausible precursor. - Review authentication logs for admin sessions from unexpected source addresses or at unexpected times. P3, within 7 days: - Add the affected products to the patch cycle with a defined SLA for KEV-listed items, and record which instances are internet-exposed so the next KEV entry does not require a fresh inventory. - Confirm that forensic triage capability exists for these devices, per the CISA Forensics Triage Requirements referenced in the NVD record. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The NVD record for CVE-2025-61624 contains no hashes, domains, IP addresses, file paths or command strings. The related KEV entries in the corpus likewise contain no atomic indicators. The sources do describe observable behaviour, so the following is offered as behavioural guidance rather than as machine-pivotable indicators. | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------------------- | -------------------------------------------------- | ------------------------------------------------------------------------------------------------ | | Authenticated admin session issuing CLI commands that write or delete files outside intended paths | Fortinet device CLI audit logs, admin session logs | Medium; behaviour is described in the NVD record but no command strings are given | | Symbolic link persistency mechanism on FortiOS | Device filesystem, post-exploit forensic review | Low for this CVE; the technique is described in CVE-2025-68686, not in the CVE-2025-61624 record | ## 6\. Detection Insufficient indicators to author detection rules. The sources provide no distinctive strings, command-line flags, file paths, registry keys, mutex names or other artefacts of the threat itself. The only concrete facts are the CVE identifier, the affected product names and the vulnerability class, none of which are threat artefacts. Authoring a rule against those would detect reporting about the vulnerability, not exploitation of it. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)** | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ---------- | ---------------- | ---- | ---------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2025-61624](https://nvd.nist.gov/vuln/detail/CVE-2025-61624?ref=f4n6.co.uk) | 6.0 Medium | ⚠ KEV 2026-10-16 | 1% | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') \[CWE-22\] vulnerability in Fortinet FortiOS 7.… | ## 7\. Sources - NVD, CVE-2025-61624 detail, https://nvd.nist.gov/vuln/detail/CVE-2025-61624, published 2026-10-15 - NVD, CVE-2025-25249 detail (Fortinet heap-based buffer overflow), https://nvd.nist.gov/vuln/detail/CVE-2025-25249 - NVD, CVE-2026-104286 detail (FortiMail path traversal), https://nvd.nist.gov/vuln/detail/CVE-2026-104286 - SecurityWeek, Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action, https://www.securityweek.com/exploited-fortinet-fortimail-zero-day-calls-for-urgent-action/ - NVD, CVE-2026-25089 detail (FortiSandbox OS command injection), https://nvd.nist.gov/vuln/detail/CVE-2026-25089 - The Hacker News, CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline, https://thehackernews.com/2026/09/cisa-flags-exploited-cisco-citrix.html - NVD, CVE-2025-68686 detail (FortiOS sensitive information exposure), https://nvd.nist.gov/vuln/detail/CVE-2025-68686 ## 8\. Adverse Trace position We assess CVE-2025-61624 as a medium-severity, post-authentication file-write and file-delete primitive that is elevated by its KEV status rather than by its CVSS score of 6.0\. The EPSS score of 1% and the admin-session precondition mean this is not a mass-exploitation event, but the KEV listing confirms it has been used, and a file-write on a firewall, proxy or switch manager is an integrity problem on a control device. The absence of named affected versions, command strings and file paths in the NVD record is a gap we will close against Fortinet's advisory before advising on version pinning. No actor is named in the reference data, so we make no attribution. We will monitor for a Fortinet PSIRT advisory with version detail and for any vendor or incident-response reporting that describes post-exploitation behaviour on these products, and we will issue a follow-up if the file-write primitive is shown to reach an executable path. Clients running FortiOS, FortiPAM, FortiProxy or FortiSwitchManager with internet-reachable management interfaces should treat the 2026-10-19 KEV due date as their own deadline and confirm admin account hygiene on those devices today. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2025-61624?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*