CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities (KEV) catalogue on 16 October 2026. The vulnerability affects Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, and may let an authenticated administrator with at least read-write permissions write or delete arbitrary files using specific CLI commands.
The flaw is a path traversal vulnerability. Its reported impact is arbitrary file creation or deletion, and exploitation requires an authenticated account with an admin profile and the specified permissions. The CVSS score is 5.4, rated Medium. Patch status is unknown, and no patch or advisory URL was provided in the supplied data.
CISA’s KEV listing indicates that active exploitation has been confirmed. Use in ransomware campaigns is unknown. CISA set 19 October 2026 as the remediation deadline for affected federal agencies.
CISA requires organisations to apply mitigations in accordance with Fortinet’s instructions and relevant BOD 26-04 guidance, including its Forensics Triage Requirements. For cloud services, agencies should follow the applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Stakeholders must assess each asset’s internet exposure and follow BOD 26-04 patching guidelines.
The requirement directly applies to Federal Civilian Executive Branch (FCEB) agencies; all organisations should review their exposure and Fortinet’s instructions.
For full details, consult the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-61624 and CISA’s KEV catalogue at https://www.cisa.gov/known-exploited-vulnerabilities-catalog.