Fortinet Patches Path Traversal Flaw in FortiOS, FortiPAM, FortiProxy, FortiSwitchManager (CVE-2025-61624) — Added to CISA KEV

Fortinet has disclosed a path traversal vulnerability, tracked as CVE-2025-61624, affecting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. According to Fortinet's PSIRT advisory, an authenticated attacker holding an admin profile with at least read-write permissions can abuse specific CLI commands to write or delete arbitrary files on the device. CISA has added this CVE to its Known Exploited Vulnerabilities (KEV) catalog, indicating it has been observed being actively exploited in the wild. No CVSS score was provided in the source data, and ransomware-campaign use is currently listed as unknown.

Why It Matters

Fortinet products sit at the network edge and are frequent targets for both opportunistic and targeted intrusions. A path traversal bug that allows arbitrary file write or delete — even one requiring an authenticated, privileged account — is significant because it can be chained with other issues (credential theft, session hijacking, or social engineering of an admin) to achieve persistence, configuration tampering, or deletion of logs and security controls. KEV inclusion means defenders should treat exploitation as a current, real-world risk rather than theoretical.

What Defenders Should Do Now

• Identify all FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager instances in your environment and check Fortinet's advisory (FG-IR-26-122) for affected versions and patched releases.
• Prioritize patching reachable management interfaces, especially any exposed to the internet or to less-trusted network segments.
• Audit and tighten admin profile assignments — since exploitation requires an admin account with read-write permissions, review who holds elevated profiles and remove unnecessary access.
• Hunt for anomalous CLI command usage on Fortinet devices, particularly commands associated with file operations, from admin sessions that deviate from normal operator behavior or originate from unusual source IPs/times.
• Review device configuration and file-integrity baselines for unexpected changes, and monitor authentication logs for suspicious admin logins preceding configuration or file-system activity.

This is developing intel based on Fortinet's PSIRT disclosure and CISA's KEV listing; further details on exploitation scope, affected version ranges, and indicators of compromise may emerge. For authoritative guidance, patched versions, and update details, see Fortinet's advisory: FG-IR-26-122.