What is CVE-2025-61624?

CVE-2025-61624 is a medium-severity vulnerability in Fortinet Fortios, classified under Path Traversal. CVSS score: 6.0/10. Published 2026-04-14.

How severe is CVE-2025-61624?

Medium severity. CVSS v3 base score is 6.0 out of 10.

Is CVE-2025-61624 known to be exploited?

Yes. CVE-2025-61624 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-10-16), indicating it is being actively exploited.

Path Traversal in Fortinet Fortios

CVE-2025-61624

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

Vulnerability class: Path Traversal (Directory Traversal)

Published 2026-04-14 · last modified 2026-10-17.

CVSS v3 metric

CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H.

EPSS exploit prediction

EPSS: 0.011 (64.6th percentile), scored 2026-10-19.

Low probability of exploitation in the next 30 days, but still tracked. 65th percentile — 64.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.011 · change: +0.006

Affected products

Fortinet Fortios — versions 7.6.0, 7.4.0, 7.2.0
Fortinet Fortipam — versions 1.7.0, 1.6.0, 1.5.0
Fortinet Fortiproxy — versions 7.6.0, 7.4.0, 7.2.0
Fortinet Fortiswitchmanager — versions 7.2.0, 7.0.0
Siemens Ruggedcom Ape1808 Firmware

Weakness classification (CWE)

CWE-22 — Path Traversal

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2026-10-16. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2026-10-19.

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

fortiguard.fortinet.com/psirt/FG-IR-26-122 (Vendor Advisory)
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e (Third Party Advisory)
134c704f-9b21-4f2e-91b3-4a467353bcc0 (Third Party Advisory)
134c704f-9b21-4f2e-91b3-4a467353bcc0 (US Government Resource)

Frequently asked questions

What is CVE-2025-61624?: CVE-2025-61624 is a medium-severity vulnerability in Fortinet Fortios, classified under Path Traversal. CVSS score: 6.0/10. Published 2026-04-14.
How severe is CVE-2025-61624?: Medium severity. CVSS v3 base score is 6.0 out of 10.
Is CVE-2025-61624 known to be exploited?: Yes. CVE-2025-61624 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-10-16), indicating it is being actively exploited.