CISA Adds Fortinet Flaw CVE-2025-61624 to Known Exploited Vulnerabilities Catalog

On October 16, CISA added CVE-2025-61624 to its catalog of vulnerabilities exploited in real-world attacks. The entry covers four Fortinet products: FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. The vulnerability itself was disclosed in April. What’s new is its addition to the Known Exploited Vulnerabilities (KEV) catalog. Luxembourg’s CIRCL created a record reflecting the CISA entry on October 16 at 18:00 UTC, or 8:00 p.m. Polish time.

What the alert means

The flaw is an improper limitation of file paths, also known as path traversal. To exploit it, an attacker must be authenticated, hold an administrator profile, and have at least read and write permissions. With specially crafted commands in the administrative interface, the attacker may then be able to write or delete arbitrary files.

This distinction matters when you assess the risk. Nothing in the description suggests that an unauthenticated outsider could take over a device. Administrators should still plan for the scenario in which an attacker abuses an account that has already been compromised. The CISA entry does not say how many organizations were affected, and it lists the vulnerability’s use in ransomware campaigns as unknown.

Who is affected

The list covers several product families and many software branches. Your review should therefore include a full inventory of devices and their versions, including systems used for access management and for proxying network traffic. Checking only your main firewall is not enough.

CISA set October 19 as the remediation deadline for the U.S. federal agencies bound by the directive. That deadline does not legally apply to Polish companies, but a KEV listing is a strong practical signal that this work should move up the priority list.

What to do now

We recommend the following steps for administrators:

• Compare the versions of every listed product against Fortinet advisory FG-IR-26-122 and choose the right upgrade path.
• Review administrator accounts, their permission scopes, and whether management interfaces can be reached from the internet.
• Preserve your logs, then look for unusual administrator logins and configuration changes that have no clear reason.
• If you suspect a breach, conduct an incident investigation. Installing the patch will not tell you what happened on the device before it was applied.

SecurHUB’s take

Vulnerabilities that require administrator privileges still deserve urgent assessment once there is confirmation that attackers are exploiting them. In security audits, it makes sense to check three things together: whether devices are up to date, what permissions accounts hold, and whether administrative actions can be reconstructed.

Sources: CIRCL — CISA catalog entry, DeSpy — confirmation of KEV addition, CVE Program — vendor description