CISA gives agencies three days to fix exploited Fortinet CLI flaw

CISA gives agencies three days to fix exploited Fortinet CLI flaw

16 October 2026: CISA has added CVE-2025-61624, a path traversal flaw in the command line of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, to its Known Exploited Vulnerabilities catalogue, with a remediation deadline of 19 October for US federal agencies. Fortinet's own advisory marks the flaw as known exploited; it is rated medium (CVSS 6.0) because the attacker must already hold an administrator profile with at least read-write permissions.

A medium score on an exploited bug

Fortinet describes the bug as an improper limitation of a pathname in the CLI interpreter that lets a privileged attacker write or delete arbitrary files by passing crafted arguments to existing commands. Its advisory, FG-IR-26-122, was first published in April after the issue was found internally, and lists the impact as escalation of privilege.

The low score reflects the precondition, not the risk once that precondition is met. An attacker who has phished or reused an administrator's credentials, or who sits on a management session, can use file writes to persist or to tamper with the device. CISA's entry flags the vulnerability for forensic triage, so agencies must look for signs of compromise as well as patch. Whether it has been used in ransomware campaigns is listed as unknown.

Fixed releases and branches with no fix

Fortinet's table splits the products into lines with a fixed release and lines where the only answer is to migrate:

• FortiOS 7.6.0 to 7.6.4: upgrade to 7.6.5 or later
• FortiOS 7.4.0 to 7.4.9: upgrade to 7.4.10 or later
• FortiOS 7.2, 7.0 and 6.4, all versions: migrate to a fixed release
• FortiProxy 7.6.0 to 7.6.4: upgrade to 7.6.5 or later
• FortiProxy 7.4.0 to 7.4.11: upgrade to 7.4.12 or later
• FortiProxy 7.2 and 7.0, all versions: migrate to a fixed release
• FortiPAM 1.7.0: upgrade to 1.7.1 or later; FortiPAM 1.0 to 1.6, all versions: migrate; FortiPAM 1.8 is not affected
• FortiSwitchManager 7.2.0 to 7.2.7: upgrade to 7.2.8; 7.0.0 to 7.0.6: upgrade to 7.0.7

Fortinet also lists a virtual patch, FG-VD-59270.0day, in FMWP database update 25.120, which helps where an upgrade has to wait.

Where the deadline bites first

The three-day window is the one CISA set for both of its additions on 16 October; the same day it gave agencies until 19 October for the BeyondTrust Remote Support flaw we covered on Friday. Private companies are not bound by the directive, but the listing confirms that attackers are using the flaw now.

The FortiOS 7.2 and 7.0 lines are the ones to check first. Neither has a fix, so the realistic choices are an upgrade to 7.4.10 or 7.6.5, the virtual patch, or a tighter list of who holds read-write admin profiles and where they can log in from. We list Fortinet as a company; our vulnerability management software category lists 16 products and our network security category six.

Related on TrustList:

• Ivanti Connect Secure zero-day lets attackers run commands unauthenticated
• Edge devices are attacked first, application servers after the patch
• FBI warns FortiBleed is still hitting exposed FortiGate VPNs

Sources

• Fortinet PSIRT advisory FG-IR-26-122 (CVE-2025-61624), 14 April 2026
• CISA Known Exploited Vulnerabilities catalogue, version 2026.10.16 (JSON feed), 16 October 2026