Fortinet Multiple Products Path Traversal (CVE-2025-61624)
Detects exploitation attempts against CVE-2025-61624, a path traversal (CWE-22) vulnerability affecting multiple Fortinet products (including FortiOS management surfaces). Attackers leverage directory traversal sequences in HTTP request paths/parameters to read sensitive files (e.g. configuration, credential stores, session data) or access resources outside the intended web root on exposed Fortinet appliances. This vulnerability is listed in CISA KEV and is being actively exploited in the wild. Detection focuses on traversal patterns, encoded traversal sequences, and anomalous access to sensitive paths against Fortinet management interfaces.
Vulnerability Intelligence
KEV — Known ExploitedAffected Software
- Vendor
- Fortinet
- Product
- Multiple Products
Weakness (CWE)
Timeline
- Disclosed
- October 16, 2026
References & Proof of Concept
- https://fortiguard.fortinet.com/psirt/FG-IR-26-122
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2025-61624
- https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html
CVSS
What is CVE-2025-61624 Fortinet Multiple Products Path Traversal (CVE-2025-61624)?
Fortinet Multiple Products Path Traversal (CVE-2025-61624) (CVE-2025-61624) maps to the Initial Access and Collection tactics — the adversary is trying to get into your network in MITRE ATT&CK.
This page provides production-ready detection logic for Fortinet Multiple Products Path Traversal (CVE-2025-61624), covering the data sources and telemetry it touches: Fortinet FortiGate/FortiOS syslog (CEF), Network Firewall logs, Web proxy logs. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Initial Access Collection
let traversalPatterns = dynamic(["../", "..%2f", "%2e%2e%2f", "..%5c", "%2e%2e/", "....//", "%252e%252e%252f", "..\\"]);
let fortiUserAgents = dynamic([""]);
CommonSecurityLog
| where DeviceVendor =~ "Fortinet"
| where RequestURL has_any (traversalPatterns) or RequestURL has_any ("/etc/passwd", "sslvpn_websession", "/config/", "system_global")
| extend DecodedUrl = url_decode(RequestURL)
| where DecodedUrl contains "../" or DecodedUrl contains "..\\"
| project TimeGenerated, SourceIP, DestinationIP, DeviceName, RequestURL, DecodedUrl, RequestMethod, DeviceAction, ApplicationProtocol
| sort by TimeGenerated descFlags HTTP requests to Fortinet devices containing path traversal sequences (raw or URL-encoded) or access to sensitive file paths, consistent with CVE-2025-61624 exploitation.
Data Sources
Required Tables
False Positives
- Legitimate vulnerability scanners (Qualys, Tenable, Rapid7) probing the appliance
- Security team authorized penetration testing of Fortinet management interface
- Malformed but benign client requests with relative path artifacts in URLs
Sigma rule & cross-platform mapping
The detection logic for Fortinet Multiple Products Path Traversal (CVE-2025-61624) (CVE-2025-61624) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: network_connection
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for CVE-2025-61624
References (5)
- https://fortiguard.fortinet.com/psirt/FG-IR-26-122
- https://nvd.nist.gov/vuln/detail/CVE-2025-61624
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Basic path traversal probe against Fortinet web interface
Expected signal: Fortinet traffic/event log entry recording an HTTP request with an encoded traversal path to /etc/passwd.
- Test 2 URL-encoded traversal to session file
Expected signal: Fortinet log entry with double-encoded traversal and sslvpn_websession reference in the URL.
- Test 3 Backslash traversal probe (Windows-style separators)
Expected signal: Fortinet log entry recording an HTTP request with ..%5c backslash traversal targeting /config.
Response Playbook
Triage
- Confirm the source IP and whether it is internal, a known scanner, or an untrusted external host; enrich with threat intel and geolocation.
- Extract and URL-decode the full request path to determine the exact file or resource targeted by the traversal (e.g. config, sslvpn_websession, credential stores).
- Check the Fortinet device response code and byte count to determine whether the traversal succeeded (HTTP 200 with large payload) versus was blocked (403/404).
- Verify the affected appliance's firmware version against the FG-IR-26-122 advisory to confirm it is in the vulnerable range.
Containment
- Block the offending source IP(s) at the perimeter and on the Fortinet device's local-in policy.
- Restrict administrative/management interface exposure to the public internet; move management to a trusted VPN or management VLAN.
- Apply the Fortinet FG-IR-26-122 patch or vendor workaround on all affected appliances as an emergency change.
Evidence Collection
- Preserve full Fortinet appliance logs (traffic, event, and admin logs) and any available HTTP request/response captures around the alert window.
- Export the device configuration backup and session/credential tables to assess what may have been exfiltrated via the traversal.
Escalation Criteria
- ! Escalate to incident response if response telemetry indicates successful retrieval of configuration, credential, or VPN session files.
- ! Escalate immediately if the same source subsequently authenticates or establishes a VPN session, indicating credential theft from the traversal.
Investigation Guide
Forensic Artifacts
- >
Fortinet device traffic and event logs showing the traversal request and HTTP response size/code. - >
Device configuration backups and sslvpn_websession artifacts indicating accessed resources. - >
Admin and VPN authentication logs for follow-on access from the same source.
Tuning Guidance
Allowlist known internal vulnerability scanners and authorized pentest source IPs to reduce noise. Tune the sensitive-path list (sslvpn_websession, /config/, /etc/passwd) to your appliance type and expose only the traversal+response-success combination for high-fidelity alerting. If decoding at ingest is unavailable, lower the repeated-request threshold to catch encoded-only probes.
Hunting Queries
Hunt for source IPs issuing repeated path traversal requests against any Fortinet device, surfacing automated scanning or exploitation campaigns.
CommonSecurityLog | where DeviceVendor =~ "Fortinet" | extend d = url_decode(RequestURL) | where d has "../" or d has "..\\" | summarize count(), make_set(RequestURL) by SourceIP, DeviceName | where count_ > 5index=fortinet | eval d=urldecode(coalesce(url,request,uri)) | where match(d,"\.\.[\/\\]") | stats count values(url) as urls by src_ip host | where count>5Atomic Red Team Tests
Sends an HTTP request with a classic ../ traversal sequence targeting a sensitive file to simulate CVE-2025-61624 probing.
Command
curl -k -s -o /dev/null -w '%{http_code}\n' 'https://FORTI_HOST/..%2f..%2f..%2f..%2fetc%2fpasswd'Cleanup
echo 'No cleanup required; read-only request'Expected Telemetry
Fortinet traffic/event log entry recording an HTTP request with an encoded traversal path to /etc/passwd.
Expected Detection
KQL/SPL rule fires on the decoded ../ sequence and sensitive path /etc/passwd.
Simulates attempts to read sslvpn_websession via double-encoded traversal sequences.
Command
curl -k -s 'https://FORTI_HOST/%252e%252e%252f%252e%252e%252fsslvpn_websession'Cleanup
echo 'No cleanup required'Expected Telemetry
Fortinet log entry with double-encoded traversal and sslvpn_websession reference in the URL.
Expected Detection
Detection matches the %2e%2e / sslvpn_websession patterns after decoding.
Sends traversal using backslash separators to test alternate encoding handling of CVE-2025-61624 detection.
Command
powershell -c "Invoke-WebRequest -Uri 'https://FORTI_HOST/..%5c..%5c..%5cconfig' -SkipCertificateCheck -UseBasicParsing"Cleanup
Remove-Item Env:\NONE -ErrorAction SilentlyContinueExpected Telemetry
Fortinet log entry recording an HTTP request with ..%5c backslash traversal targeting /config.
Expected Detection
Rule fires on the ..%5c encoded backslash traversal and /config path.