· CVE-2025-61624

Fortinet FortiOS Path traversal

6.5 CVSS · mediumExploited

Path traversal in Fortinet FortiOS. Exploitable over the network, only with a highly privileged account, without any user action. CVSS 6.5 (medium). According to CISA it is already being exploited. The vendor names the fixed versions in its report.

Vendor security advisory

fortiguard.fortinet.com · The vendor’s information prevails.

At a glance

CVE
CVE-2025-61624
Product
Fortinet FortiOS
Vendor
Fortinet
Affected versions
  • ≥ 7.6.0, ≤ 7.6.4
  • ≥ 7.4.0, ≤ 7.4.9
  • ≥ 7.2.0, ≤ 7.2.13
  • ≥ 7.0.0, ≤ 7.0.19
  • ≥ 6.4.0, ≤ 6.4.16
per the vendor or CVE issuer
Fixed in
see the vendor’s report
CVSS
6.5 (medium)
CVSS 3.1, scored by NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Known exploited
Yes, per CISA (in the KEV catalog since 16 October 2026)
Weakness type
CWE-22 (Path traversal)
Published
Last modified

What to do

  1. The fixed versions are listed in the vendor’s report. Update to the right version for your release line.
  2. Read the vendor’s report: it gives the exact versions and, where available, workarounds in case you cannot update right away.
  3. Since it is already exploited: after updating, check whether the system was compromised before.
  4. Also check test, staging and forgotten installations of the same software.
Vendor security advisory ↗

Original description

From the CVE record. The summary above is built from the structured data.

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

Name at CISA: Fortinet Multiple Products Path Traversal Vulnerability

Official references

Sources

Data from NIST’s NVD and CISA’s KEV catalog, retrieved on 1 November 2026. This product uses data from the NVD API but is not endorsed or certified by the NVD. No liability is accepted for this information.

NVD entry ↗CVE.org record ↗CISA KEV catalog ↗

Which software versions does your website give away? The free security check finds out.

Check for free