Fortinet Multiple Products Path Traversal Vulnerability Added to CISA KEV

What's on the official record

16 October — CISA added CVE-2025-61624 to the Known Exploited Vulnerabilities Catalog (catalog version 2026.10.21). The entry describes a path traversal vulnerability (CWE-22) in Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. CISA set a remediation due date of 19 October 2026 for federal civilian agencies. The record names no fixed version; Fortinet FortiOS is affected through 7.6.4 and through 7.4.9. The catalog does not record known ransomware use. FIRST's EPSS model estimates a 0.011 probability of exploitation (65th percentile, 23 October 2026). CISA's ADP assesses exploitation as active, automatable as no, and impact as total.

Assessment

For a platform or AI-stack owner, the record lets you check whether any FortiOS, FortiPAM, FortiProxy, or FortiSwitchManager instance in your estate runs a version at or below the affected lines, and whether any admin-profile account with read-write permissions could reach the CLI commands named in the advisory. The record names no fixed version, so the decision is to isolate affected appliances and apply the vendor's FG-IR-26-122 mitigations rather than wait for a patch line to be published.

For a cyber underwriter, the record lets you price or condition coverage on whether an insured has applied the vendor's FG-IR-26-122 mitigations and restricted admin-profile CLI access on the four affected products. The catalog does not record known ransomware use, and CISA's ADP marks the vulnerability as not automatable, which bears on how you weigh exposure against the active-exploitation flag when binding or renewing.

What would change this call

A fixed version published by Fortinet for any of the four affected products would move the platform owner's decision from isolate-and-mitigate to patch. A change in the catalog's ransomware field, or a CISA ADP reassessment of automatable to yes, would shift the underwriter's pricing and control requirements.

What to check next

Confidence

Filed 25 October 2026 from the record dated 16 October 2026.

Sources

[1] Fortinet Multiple Products Path Traversal Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2025-61624

[2] CVE record CVE-2025-61624 — https://www.cve.org/CVERecord?id=CVE-2025-61624

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog