CISA added CVE-2025-61624 to KEV on Oct 16 with a federal due date of Oct 19 and a forensic-triage flag. Fortinet's FG-IR-26-122 (published Apr 14, 2026, now marked Known Exploited: Yes) describes a path traversal in the CLI that lets a privileged admin write or delete arbitrary files with crafted arguments to existing commands (CVSS 6.0, so it needs an admin account with read-write rights). Fixed in FortiOS 7.6.5 and 7.4.10, FortiProxy 7.6.5 and 7.4.12, FortiPAM 1.7.1 and FortiSwitchManager 7.2.8 and 7.0.7; FortiOS 7.2, 7.0 and 6.4 and older FortiProxy and FortiPAM branches must migrate to a fixed release. Unit 42's PEERSTITCH report (Oct 15) says CL-STA-0954 used this bug after stealing FortiGate configs and credentials via FortiManager, which is how a 'needs admin' bug becomes a persistence step.