Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager
CVE-2025-61624: path traversal across FortiOS, FortiPAM, FortiProxy and FortiSwitchManager.
A path traversal flaw in Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, with a 2025 identifier and an NVD record from April 2026, that CISA added to its catalogue on 16 October 2026. It needs an authenticated attacker.
Exploitation
- Exploitation
- Exploited in the wild
- CISA KEV
- Listed 16 Oct 2026
- Federal due date 19 Oct 2026; catalogue read 31 Oct 2026
- EPSS
- 1.3% in 30 days
- Percentile 71%, scored 29 Oct 2026
- 6.0Medium, (CVSS 3.1)Scored by NVD
- 1.3%EPSS, chance of exploitation in 30 daysPercentile 71%; scored 29 Oct 2026
- 14 AprPublished by NVD14 Apr 2026; record read 17 Oct 2026
Versions
Affected and fixed.
.
| Affected | Fixed in |
|---|---|
| FortiPAM before 1.7.1 | 1.7.1 |
| FortiSwitchManager before 7.0.7 | 7.0.7 |
| FortiSwitchManager before 7.2.8 | 7.2.8 |
| FortiOS before 7.4.10 | 7.4.10 |
| FortiProxy before 7.4.12 | 7.4.12 |
| FortiOS and FortiProxy before 7.6.5 | 7.6.5 |
What to do now
Confirm every Fortinet device on the internet runs a fixed release and review it for access before the fix. The October list sits in our digest.
How to check exposure
FortiOS 7.6.0 through 7.6.4 and 7.4.0 through 7.4.9, every 7.2, 7.0 and 6.4 release, FortiPAM 1.7.0 and every earlier branch, FortiProxy 7.6.0 through 7.6.4 and 7.4.0 through 7.4.11 and every 7.2 and 7.0 release, and FortiSwitchManager 7.2.0 through 7.2.7 and 7.0.0 through 7.0.6 are affected. The Fortinet PSIRT advisory FG-IR-26-122, opens in a new tab names the fixed release per product.
The NVD configuration ends the affected FortiOS ranges at 7.6.5 and 7.4.10 and the FortiProxy ranges at 7.6.5 and 7.4.12. The firmware version prints on each device's dashboard.
Who this reaches in Australia
A flaw added to the catalogue six months after its record is a reminder that the exploited list is read against the inventory every month as well as on disclosure.
Under the Essential Eight the fix is patch operating systems for internet-facing network devices, 48 hours where a working exploit exists, and FortiOS 7.2 and earlier branches with no fix are the unsupported versions the model says to replace.
Timeline
Disclosed, published, listed, advised.
- : Published by NVD
- : Added to the CISA Known Exploited Vulnerabilities Catalog
- : NVD record last modified
- : CISA due date for US federal agencies
Questions, answered.
Why is a 2025 CVE in an October 2026 digest?
CISA added it to the Known Exploited Vulnerabilities Catalog on 16 October 2026, so it joined that month's additions. Our digest notes six of the month's entries carried identifiers from 2025 or earlier.
Does the attacker need credentials?
Yes. The NVD description says an authenticated attacker, so a stolen or weak administrative credential is the first step, which is why multi-factor authentication on the administrative interface matters beside the patch.
Which Fortinet releases fix it?
the Fortinet advisory FG-IR-26-122 lists the fixed release per product. The NVD configuration gives 7.6.5 and 7.4.10 for FortiOS, 7.6.5 and 7.4.12 for FortiProxy, 1.7.1 for FortiPAM and 7.2.8 and 7.0.7 for FortiSwitchManager.
Provenance
Sources, and when they were read.
Every source was read 31 Oct 2026.
- 1NVD, CVE-2025-61624NIST. US Government work, public domain.
- 2CISA, Known Exploited Vulnerabilities CatalogUS Government work, public domain.
- 3FIRST, EPSS score for CVE-2025-61624EPSS terms of use.
- 4Black Shard, Essential Eight assessment
- 5Black Shard, Exploited in October 2026: Ivanti, Windows, PAN-OS, Cisco and Ahsay lead 26 additions
- 6Vendor reference for CVE-2025-61624: fortiguard.fortinet.comfortinet.com. terms of use.
- 7Vendor reference for CVE-2025-61624: unit42.paloaltonetworks.compaloaltonetworks.com. terms of use.