Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2026-04-14

CVE-2025-61624

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

Signals

Exploited in the wild
Yesadded 2026-10-16 · due 2026-10-19. An observation, not a forecast.
EPSS · 30-day forecast
1%Chance of exploitation in the next 30 days, 47th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · MEDIUM
6.0CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Internet exposure
335,247FortiGate hosts Shodan could see worldwide on 2026-10-05. A scan count, not an inventory.

Exploits

not checked

Not checked yet. Our exploit watch has not looked at this CVE, so this says nothing either way.

On the wire

1 dispatch
  1. CISA adds CVE-2025-61624 (Fortinet Multiple Products) to the Known Exploited Vulnerabilities catalogKEV

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.