CVE-2025-61624 Fortinet: a MEDIUM Flaw in CISA KEV — FortiOS, FortiProxy, FortiPAM, FortiSwitchManager

CVE-2025-61624 was published on April 14, 2026. It entered the CISA KEV catalog on October 16, 2026 — six months later — with a deadline of October 19.

The twist: it's rated MEDIUM (6.5) and requires an administrator account with write permissions. It doesn't get an attacker onto the device. It serves those who are already there.

It's the second Fortinet KEV addition this month, after FortiMail on October 1.

The Vulnerability

NVD description (excerpt):

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS […] may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

Two vectors for the same flaw

NVD and Fortinet don't score it the same way: NVD uses network access (AV:N, 6.5), Fortinet local access (AV:L, 6.0). The difference comes down to how "CLI commands" are read: a FortiGate's CLI is reachable remotely (SSH, web console), hence NVD's choice.

Either way, the factor pulling the score down is the same: PR:H, high privileges required.

Why an "admin required" flaw ends up in KEV

A flaw that needs an admin account looks pointless: if the attacker is admin, they already have control. Except that writing or deleting arbitrary files goes beyond what normal device administration allows. That's typically what is used to:

• install persistence that survives reboots and configuration updates;
• wipe traces from the filesystem;
• modify system files the admin interface doesn't expose.

NVD doesn't describe the exploitation campaign. But the flaw's profile fits a post-compromise step: an attacker gains admin access through another flaw or stolen credentials, then uses CVE-2025-61624 to settle in for the long run. The KEV entry also requires forensic triage (BOD 26-04) on top of updating.

Affected and Fixed Versions

⚠️ These numbers are bounds from NVD, not necessarily the release to install. Check the recommended version for your branch in Fortinet advisory FG-IR-26-122.

"All versions" branches: FortiOS 7.2, 7.0 and 6.4, and FortiProxy 7.2 and 7.0, have no fixed version in NVD's data. The answer is a migration to a maintained branch.

Siemens RUGGEDCOM APE1808 also appears in NVD's configuration (the appliance embeds a Fortinet solution): Siemens publishes its own guidance in advisory SSA-975644.

Check your version:

get system status

Six Months of Delay, Again

The pattern is the same as for CVE-2025-25249 in September: published with no known exploitation, a moderate score, the CVE joins the backlog. Months later, exploitation is observed and CISA gives three days.

Here the score is even more misleading. A 6.5 with PR:H is exactly the kind of flaw a sensible team sets aside. Yet it's the one that lets an attacker stay on an already compromised device.

Detection

• Unknown or recently created admin accounts: show system admin
• Admin logins from unusual addresses, especially over SSH
• Unusual CLI commands in event logs, around file handling
• Files appearing or disappearing with no related update: the flaw allows both writing and deleting
• Outbound traffic initiated by the device itself

execute log filter category event
execute log display
get system admin list

Mitigation

1. Update to a fixed release on your branch

The CISA deadline is October 19.

2. Deal with admin accounts

The flaw requires an admin account: that's where the real defense lies.

• Inventory admin accounts and remove unused ones
• Enforce multi-factor authentication on administrative accounts
• Restrict administration to trusted hosts, never from the internet
• Keep read-write profiles to the strict minimum

3. Get off unfixed branches

FortiOS 7.2, 7.0, 6.4 and FortiProxy 7.2, 7.0: no temporary measure replaces a maintained branch.

4. If you suspect a compromise

1. Assume the update does not remove files already planted
2. Verify firmware integrity with Fortinet's tools
3. Rotate all admin credentials, plus VPN, LDAP and RADIUS secrets
4. Compare the configuration against a backup from before the suspect period

Why Continuous Monitoring of Your Fortinet Estate Matters

A MEDIUM that requires an admin account triggers no alert for most teams. Its entry into KEV six months later should trigger one immediately, provided you know which versions run on each device.

With cveo.tech, inventory your Fortinet devices with their exact versions, and get an automatic alert whenever a CVE affecting them enters the CISA KEV catalog, whatever its score.