Fortinet Products Path Traversal Vulnerability (CISA KEV Alert)

Summary: CISA is warning about an actively exploited path traversal vulnerability (CVE-2025-61624) in multiple Fortinet products. This flaw could allow an authenticated attacker to write or delete arbitrary files.

This CISA KEV alert addresses a path traversal vulnerability (CVE-2025-61624) affecting multiple Fortinet products, including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. Such vulnerabilities allow an attacker to access directories in the file system that they would not normally be able to reach. CISA’s designation as “actively exploited” indicates that this flaw is being used in real-world attacks.

Technically, this is a path traversal vulnerability exploited via specific CLI commands. The attacker needs to be authenticated, have an admin profile, and possess at least read-write permissions. When these conditions are met, the attacker can write or delete arbitrary files. This situation can severely compromise system integrity.

For live systems and operations, this means that network infrastructures using Fortinet products are at significant risk. Since critical components like firewalls, proxies, and network management systems are affected, exploitation of this vulnerability could completely jeopardize network security. It is imperative for administrators to immediately apply patches provided by Fortinet for the affected products.

Network and infrastructure engineers must ensure that Fortinet products are up-to-date and, in particular, tighten the security of administrative accounts. Such vulnerabilities demonstrate that even authenticated users can perform destructive actions on the system, making privilege management critically important.

🔗 Source: CISA KEV Catalog
📡 Authoritative feeds & live tracking: Radar