CISA Adds Actively Exploited Fortinet CLI Flaw CVE-2025-61624 to KEV

CISA added CVE-2025-61624, a path traversal flaw in the command-line interface of several Fortinet products, to its Known Exploited Vulnerabilities catalog on Oct. 16, meaning it has evidence of active exploitation. It set an Oct. 19 remediation deadline.

The flaw needs admin access to abuse. An attacker who already holds an admin profile with at least read-write permissions can write or delete arbitrary files by passing crafted arguments to existing CLI commands, Fortinet says. Fortinet classes the impact as escalation of privilege and now marks the bug as known exploited in advisory FG-IR-26-122, first published April 14, 2026.

Fixed releases are available for current branches. FortiOS 7.6.0 through 7.6.4 is fixed in 7.6.5, and 7.4.0 through 7.4.9 in 7.4.10. FortiProxy 7.6.0 through 7.6.4 is fixed in 7.6.5, and 7.4.0 through 7.4.11 in 7.4.12. FortiSwitchManager 7.2.0 through 7.2.7 is fixed in 7.2.8, and 7.0.0 through 7.0.6 in 7.0.7. FortiPAM 1.7.0 is fixed in 1.7.1.

Older branches have no patch. Every version of FortiOS 6.4, 7.0 and 7.2, FortiProxy 7.0 and 7.2, and FortiPAM 1.0 through 1.6 is affected, and Fortinet tells those customers to migrate to a fixed release. FortiPAM 1.8 is not affected. Fortinet also lists a FortiGuard virtual patch, FG-VD-59270.0day.

Fortinet and NVD score it differently. Fortinet, the CVE Numbering Authority, rates it 6.0 (medium) under CVSS 3.1, or 5.4 after temporal adjustments. NVD scored it 6.5 (medium), treating the attack vector as network rather than local.

CISA's entry ties the deadline to BOD 26-04. It directs organizations to apply Fortinet's mitigations in line with Binding Operational Directive 26-04 and CISA's forensics triage requirements, or to stop using the product if mitigations are unavailable.