Fortinet path traversal flaw is being exploited: apply vendor fixes now

CVE-2025-61624 is a path traversal flaw in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. It could let an authenticated attacker write or delete arbitrary files by using specific command line instructions.

The attacker needs an admin profile with at least read-write permissions. That limits who can use it, but stolen or weak admin credentials would meet that bar.

CISA has added this flaw to its Known Exploited Vulnerabilities catalog. That means CISA has evidence it is being exploited. CISA lists a federal due date of 2026-10-19. Whether ransomware groups are using it is unknown.

What to do: - Check Fortinet's advisory for the exact affected versions and fixed versions. We have not listed them here. - Apply the vendor's fixes or mitigations as soon as you can. - Review who has admin accounts on these devices. Remove unused ones, use strong unique passwords and turn on multi-factor authentication. - Limit admin access so it is not reachable from the open internet. - Look for unexpected file changes or deletions and unusual admin logins. CISA also asks for forensic triage, so follow its guidance if you suspect misuse. - If no mitigation is available for your product, CISA says to stop using it.