Fortinet Patches CVE-2025-61624 Path Traversal Across Four Products

Key points

• CVE-2025-61624 affects FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager.
• Exploitation requires an authenticated session with administrative rights and write access.
• The flaw enables directory traversal, unrestricted file creation, and file removal.
• CISA and Fortinet urge mitigation or, if no fix exists, taking exposed systems offline.

Fortinet has disclosed a directory traversal vulnerability tracked as CVE-2025-61624 that touches four of its management platforms: FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. CISA has echoed the vendor's warning, signaling that federal and public-sector defenders should treat the issue as actionable.

Exploiting the flaw requires a session that has already been authenticated with administrative-level privileges and write access. That lowers the remote-attacker bar but raises the value of stolen or misused credentials — an insider, a compromised service account, or an attacker who has already escalated could use traversal to create or remove files anywhere the process can reach.

Arbitrary file writes can mean tampered configurations, planted scripts, or persistent backdoors; arbitrary deletes can break logging, wipe policy files, or render a device unusable. Because the affected products sit at the edge of many K-12 networks, a single admin session compromise could cascade.

CISA's guidance mirrors Fortinet's: install the available mitigations, follow the vendor's instructions precisely, and assess how much of the management surface is exposed to the internet. Where no fix exists, the advice is blunt — stop using the product.

Defenders should inventory versions, restrict management interfaces, audit admin activity, and watch for unusual file operations. Expect patches and further advisories; until then, treat admin access as the last line of defense.

What to do now

1. Inventory every instance of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager in your environment.
2. Apply the vendor's mitigations or upgrade to a fixed release as soon as Fortinet publishes one.
3. If no mitigation exists for a system, isolate it from the internet and consider decommissioning it.
4. Restrict administrative access: enforce MFA, use dedicated jump hosts, and audit who holds read-write roles.
5. Review logs for path traversal attempts and unexpected file writes or deletions in system directories.
6. Monitor CISA and Fortinet advisories for updates; segment management planes from user networks.

Original source

CISA Known Exploited Vulnerabilities