peter bassill · operator
$ cve CVE-2025-61624 JSON

CVE-2025-61624 KEV

6.0
MEDIUM · CVSS 3.1 · EPSS 0.6% (pctl 47)

Patch first

On CISA KEV — known exploited in the wild, due 2026-10-19.

Description

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

Scoring

CVSS6.0 (MEDIUM, v3.1)
VectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
EPSS0.58% — more likely to be exploited than 47% of all CVEs
WeaknessCWE-22
On CISA KEVyes — remediate by 2026-10-19
Public exploitnone known
Published2026-04-14
Last modified2026-10-16

CISA KEV

NameFortinet Multiple Products Path Traversal Vulnerability
Added2026-10-16
Due2026-10-19
Vendor / productFortinet / Multiple Products
Ransomware usenone reported

Affected (6)

VendorProduct
fortinetfortios
fortinetfortipam
fortinetfortiproxy
fortinetfortiswitchmanager
siemensruggedcom ape1808
siemensruggedcom ape1808 firmware

References

→ the Explorer  ·  watch your stack  ·  NVD