Fortinet CVE-2025-61624: patch FortiOS, FortiProxy, FortiPAM

What CVE-2025-61624 is and who it affectsCVE-2025-61624 is a path traversal vulnerability (CWE-22) in several Fortinet products. According to the NVD,...

What CVE-2025-61624 is and who it affects

CVE-2025-61624 is a path traversal vulnerability (CWE-22) in several Fortinet products. According to the NVD, an authenticated attacker with an admin profile and at least read-write permissions can write or delete arbitrary files through specific CLI commands. The flaw is rated CVSS 3.1 6.5, which is MEDIUM severity, so it is not a critical vulnerability, but it still deserves prompt attention because it is already being exploited.

The affected versions listed by the NVD are:

FortiOS: 6.4.0 up to (but not including) 7.4.10, and 7.6.0 up to (but not including) 7.6.5. The NVD also lists FortiOS 7.2 all versions, 7.0 all versions and 6.4 all versions in its description.
FortiPAM: 1.0.0 up to (but not including) 1.7.1. The NVD description also mentions FortiPAM 1.7.0 and all versions from 1.0 to 1.6.
FortiProxy: 7.0.0 up to (but not including) 7.4.12, and 7.6.0 up to (but not including) 7.6.5. The NVD description also lists FortiProxy 7.2 all versions and 7.0 all versions.
FortiSwitchManager: 7.0.0 up to (but not including) 7.0.7, and 7.2.0 up to (but not including) 7.2.8.

The NVD also references Siemens Ruggedcom APE1808 firmware as affected. If your organisation in Spain or Catalonia runs any of these Fortinet products, especially as an internet-facing gateway, VPN concentrator or management appliance, you should check the exact version in use.

Why it is urgent: already exploited in real attacks

CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities (KEV) catalogue on 2026-10-16, which means there is evidence of exploitation in the wild. CISA gave US federal agencies a deadline of 2026-10-19 to apply mitigations in line with the vendor's instructions, following BOD 26-04 guidance on prioritising security updates based on risk. The KEV entry does not state that the flaw has been used in ransomware campaigns, but the fact that it is in the catalogue is enough reason to act quickly.

For a small or medium-sized business, a compromised Fortinet appliance can become an entry point to the internal network. Even though the CVSS score is medium, the combination of admin-level access and file write or delete operations can lead to configuration tampering, persistence or disruption of services. In the current landscape, attackers often chain medium-severity flaws with other techniques to escalate their reach.

What to do today

Start by inventorying every Fortinet instance in your environment: FortiOS on firewalls, FortiProxy, FortiPAM and FortiSwitchManager. Record the exact firmware version and compare it with the affected ranges above. If you are unsure, the management interface or the vendor's support portal will show the build number.

Next, apply the update or mitigation indicated in the official Fortinet advisory FG-IR-26-122. The NVD does not specify a fixed version in the data we have, so follow the vendor's instructions rather than assuming a particular release. For Siemens Ruggedcom APE1808, check the Siemens advisory SSA-975644.

After patching, review logs for signs of intrusion. Look for unusual CLI commands executed by admin accounts, unexpected file changes, new local users or scheduled tasks, and any outbound connections that do not match your baseline. Restrict management access to trusted networks and disable internet-facing administrative interfaces where possible. CISA's guidance also asks organisations to evaluate each asset's internet exposure and to discontinue use of the product if mitigations are unavailable.

How a cybersecurity team like ALMC can help

Keeping track of firmware versions, vendor advisories and exposure across a mixed estate is a lot to ask of a small IT team. At ALMC we work with SMEs, online shops and companies across Lleida, Barcelona, Tarragona and Girona to close these gaps before they are exploited. That includes security audits and pentesting, server hardening, monitoring and incident response, as well as maintenance and updates for WordPress, PrestaShop and Joomla and repair of hacked websites. If you need a second pair of hands to verify whether CVE-2025-61624 affects your Fortinet appliances, or to review what is exposed to the internet, our team can help you prioritise the work and document it for GDPR compliance.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.