Patch Now: CISA Confirms Attacks on Fortinet Multiple Products Flaw CVE-2025-61624
The Fortinet Multiple Products bug is confirmed exploited in the wild. U.S. agencies have until October 19, 2026 to patch.
Key points
- CVE-2025-61624 affects Fortinet Multiple Products and is exploited in the wild.
- CISA added it to the KEV catalog on October 16, 2026.
- Federal agencies must remediate by October 19, 2026.
Attackers are exploiting a path traversal flaw in Fortinet Multiple Products, according to CISA, which added the bug, tracked as CVE-2025-61624, to its Known Exploited Vulnerabilities catalog on October 16, 2026.
At a glance
- CVE
- CVE-2025-61624
- Vendor
- Fortinet
- Product
- Multiple Products
- CVSS
- 6.0 MEDIUM
- Weakness
- path traversal
- Exploited
- Yes (CISA KEV)
- Ransomware use
- Unknown
- Patch deadline (FCEB)
- October 19, 2026
What we know about CVE-2025-61624
CISA's catalog entry describes the issue as follows: FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
The National Vulnerability Database lists a CVSS base score of 6.0 (Medium), vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H.
The NVD record adds: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | fortios | >= 6.4.0, < 7.4.10 |
| Fortinet | fortios | >= 7.6.0, < 7.6.5 |
| Fortinet | fortipam | >= 1.0.0, < 1.7.1 |
| Fortinet | fortiproxy | >= 7.0.0, < 7.4.12 |
| Fortinet | fortiproxy | >= 7.6.0, < 7.6.5 |
| Fortinet | fortiswitchmanager | >= 7.0.0, < 7.0.7 |
| Fortinet | fortiswitchmanager | >= 7.2.0, < 7.2.8 |
| Siemens | ruggedcom ape1808 firmware | see advisory |
Why this matters
CISA does not currently link this vulnerability to ransomware campaigns, but KEV listings mean exploitation has already been observed. Under CISA's binding operational directives, Federal Civilian Executive Branch agencies must remediate it by October 19, 2026. CISA urges every organisation, not only federal agencies, to treat KEV entries as a patching priority.
What should you do?
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Apply the vendor's fix or mitigation now; CISA lists the bug as exploited in real attacks.
- If no patch is available, follow the vendor's workaround or take the product offline.
- Check logs on exposed systems for signs of compromise before and after patching.
- Restrict management interfaces so they are not reachable from the internet.
What to do and how to stay safe: CVE-2025-61624
- Vulnerability severity scores ignore your specific architecture and context.
- Exploitability depends on network exposure and user behavior, not just code flaws.
- Prioritization requires continuous asset inventory and threat intelligence alignment.
Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2025-61624?
CVE-2025-61624 is a path traversal vulnerability in Fortinet Multiple Products.
How severe is CVE-2025-61624?
It has a CVSS score of 6.0 MEDIUM.
Is CVE-2025-61624 being exploited?
Yes. CISA lists it in its Known Exploited Vulnerabilities catalog, which means attacks have been observed.
What is the deadline to patch CVE-2025-61624?
US federal civilian agencies must remediate it by October 19, 2026. Other organisations are urged to treat it as a priority.
