On October 16, CISA placed CVE-2025-61624 in its exploited-vulnerabilities catalog. An attacker who already has an admin profile and at least read-write permissions can use a path traversal flaw in the command-line interpreter to write or delete arbitrary files. The affected systems are FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. CISA gives federal agencies an October 19 action date.
Fortinet first published its advisory on April 14. The new reason to revisit those appliance inventories is the exploitation designation and its short deadline. Fortinet also marks the issue “Known Exploited: Yes.” Scope the people and automation holding privileged CLI access alongside the installed release; the attack described here begins with an authenticated, sufficiently privileged account.
Privileged CLI reaches appliance files
Fortinet places the flaw in the command-line interpreter. Its advisory says a privileged attacker can achieve arbitrary file writes or deletions “via specifically crafted arguments to existing commands.” The path traversal lets a command operate beyond its intended directory. The resulting file changes can damage the appliance or disrupt its operation. The Fortinet-authored CVE record describes the access condition as an admin profile with at least read-write permissions.
Review who can start a CLI session, including management accounts and automation with the required profile. Compare privileged session history and any available appliance file-change or configuration-change evidence around those sessions. Correlate unusual file changes with the account and CLI session timeline.
If a shared admin or automation account reaches several appliances, review its CLI sessions on each affected device. Compare those times with the installed builds and any retained file or configuration changes. An appliance now on a fixed release may still have earlier changes to investigate.
Match each product to its fix
Fortinet’s release table sets different boundaries for different products. Compare the installed version on each device with the applicable row before choosing an upgrade. The fixed releases below are the first fixed builds named in its advisory.
| Product | Affected releases | Fortinet’s direction |
|---|---|---|
| FortiOS | 7.6.0–7.6.4; 7.4.0–7.4.9 | Upgrade to 7.6.5 or 7.4.10 or later, respectively |
| FortiOS | All 7.2, 7.0 and 6.4 releases | Migrate to a fixed release |
| FortiPAM | 1.7.0 | Upgrade to 1.7.1 or later |
| FortiPAM | All 1.6 through 1.0 releases | Migrate to a fixed release |
| FortiProxy | 7.6.0–7.6.4; 7.4.0–7.4.11 | Upgrade to 7.6.5 or 7.4.12 or later, respectively |
| FortiProxy | All 7.2 and 7.0 releases | Migrate to a fixed release |
| FortiSwitchManager | 7.2.0–7.2.7; 7.0.0–7.0.6 | Upgrade to 7.2.8 or 7.0.7 or later, respectively |
FortiPAM 1.8 is explicitly listed as unaffected in the advisory. For older affected branches, choose a fixed release with Fortinet’s upgrade-path tool to plan the move. Its advisory also lists virtual patch FG-VD-59270.0day in FMWP database update 25.120; confirm whether that protection is deployed on your environment while scheduling the vendor-directed release change.
CISA sets an October deadline
CISA’s KEV entry instructs agencies to apply vendor-directed mitigations, perform forensic triage and evaluate each asset’s internet exposure. Its October 19 date is the federal action deadline for this entry. CISA marks ransomware campaign use as “Unknown”; treat the exploitation finding as the reason to prioritize the work without assigning an actor or campaign to your own environment.
CISA calls for an internet exposure review; exploitation of this flaw requires an authenticated administrator with read-write CLI permissions. Map management paths from jump hosts, VPNs and automation systems to each affected appliance, then check the accounts allowed to use those paths. Restrict privileged CLI access to the operators and systems that need it while the upgrades are arranged.
Verify releases and privileged access
Start with an inventory of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager devices. Record each installed build and compare it with Fortinet’s product-specific table. For older affected branches, plan migration to a fixed line with Fortinet’s upgrade-path tool and record the intended target release. Then review privileged profiles and CLI session records for those affected devices, paying particular attention to unexpected administrator use and file or configuration changes. Where those records show suspicious activity, preserve the evidence and follow your incident process alongside remediation; a successful upgrade addresses future use of the flawed command interpreter.
After the upgrade or migration, read the running version back from each appliance and confirm it is on the applicable fixed branch. Recheck that only intended administrators and automation can start read-write CLI sessions. The running version confirms the fix. Privileged session and file-change history helps identify earlier use of the flawed command interpreter.