---
title: CISA adds Fortinet CLI path traversal CVE-2025-61624 to KEV; FortiOS, FortiProxy, FortiPAM and FortiSwitchManager, due Oct 19 | ctxsec
url: https://ctxsec.com/items/kev-fortinet-cve-2025-61624
description: ""
status: "confirmed (CISA KEV + Fortinet PSIRT)"
published: 2026-10-16
---

> 

[← Cybersecurity News](/news) · [markdown](/items/kev-fortinet-cve-2025-61624.md)

confirmed (CISA KEV + Fortinet PSIRT)

2026-10-16

### CISA adds Fortinet CLI path traversal CVE-2025-61624 to KEV; FortiOS, FortiProxy, FortiPAM and FortiSwitchManager, due Oct 19

CISA added CVE-2025-61624 to KEV on Oct 16 with a federal due date of Oct 19 and a forensic-triage flag. Fortinet's FG-IR-26-122 (published Apr 14, 2026, now marked Known Exploited: Yes) describes a path traversal in the CLI that lets a privileged admin write or delete arbitrary files with crafted arguments to existing commands (CVSS 6.0, so it needs an admin account with read-write rights). Fixed in FortiOS 7.6.5 and 7.4.10, FortiProxy 7.6.5 and 7.4.12, FortiPAM 1.7.1 and FortiSwitchManager 7.2.8 and 7.0.7; FortiOS 7.2, 7.0 and 6.4 and older FortiProxy and FortiPAM branches must migrate to a fixed release. Unit 42's PEERSTITCH report (Oct 15) says CL-STA-0954 used this bug after stealing FortiGate configs and credentials via FortiManager, which is how a 'needs admin' bug becomes a persistence step.

Sources: [Fortinet PSIRT FG-IR-26-122](https://fortiguard.fortinet.com/psirt/FG-IR-26-122) · [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [Unit 42: PEERSTITCH FortiGate implant](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)