Fortinet CLI Path Traversal Hit CISA KEV 185 Days After Fortinet Already Patched It

On October 16, 2026, CISA added CVE-2025-61624 to the Known Exploited Vulnerabilities catalog. Fortinet published advisory FG-IR-26-122 on April 14, 2026. That is roughly 185 days between “here is a medium CLI path traversal for admins” and “federal due date October 19 because someone is actually using it.” CVSS 6.0. Authenticated. Admin profile with read-write. Arbitrary file write or delete via crafted CLI arguments. The industry will call this nuanced. I call it the patch calendar as performance art.

Fortinet’s PSIRT page marks Known Exploited: Yes, Attack Type: Authenticated, Severity: Medium, CVSSv3 6.0 (temporal 5.4). CWE-22 path traversal in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. CISA’s same-day catalog dump also included BeyondTrust’s CVSSv4 9.3 Remote Support disaster. Same KEV day, very different vibes. Both due October 19. Both marked for forensic triage under BOD 26-04.

What the bug actually is

CISA’s short description: FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Fortinet’s wording matches: crafted arguments to existing commands, privileged attacker, arbitrary write or delete.

• CVE: CVE-2025-61624
• Advisory: FG-IR-26-122 (published 2026-04-14)
• CVSSv3: 6.0 (Fortinet); CISA still put it on KEV because exploitation evidence beats vibes
• Prerequisite: admin profile with at least read-write, CLI access
• Virtual patch: FG-VD-59270.0day in FMWP db update 25.120
• KEV: added 2026-10-16, due 2026-10-19, forensic triage: Yes

Fixed trains (quote the advisory, do not invent builds)

• FortiOS 7.6.0-7.6.4 → 7.6.5+
• FortiOS 7.4.0-7.4.9 → 7.4.10+
• FortiOS 7.2 / 7.0 / 6.4: all versions → migrate to a fixed release (no in-train fix listed)
• FortiProxy 7.6.0-7.6.4 → 7.6.5+; 7.4.0-7.4.11 → 7.4.12+; 7.2 and 7.0 → migrate
• FortiPAM 1.7.0 → 1.7.1+; 1.6 and older trains → migrate; 1.8 not affected
• FortiSwitchManager 7.2.0-7.2.7 → 7.2.8+; 7.0.0-7.0.6 → 7.0.7+

If your CMDB still says “we are on 7.2 so we are fine,” read the migrate row again. Fine is a feeling. Migrate is a ticket.

Why a 6.0 authenticated CLI bug still eats your week

Authenticated does not mean harmless. It means the attacker already has admin-class CLI. That can be a phished firewall admin, a stolen TACACS session, a jumphost that was already sad, or post-exploitation from a different Fortinet hole you forgot to patch in 2024. Path traversal to arbitrary write/delete on a firewall or proxy is how persistence and log sabotage get boringly reliable. CISA does not add medium CVSS footnotes to KEV for sport. Someone demonstrated exploitation evidence that cleared their bar.

Neither Fortinet’s public advisory timeline nor CISA’s alert names an actor or a victim. Do not invent one for LinkedIn. Do invent a change window.

What to actually do

1. Inventory FortiOS, FortiProxy, FortiPAM, FortiSwitchManager builds. Map each row to FG-IR-26-122.
2. Upgrade or migrate per the table. Schedule the reboot. Document post-change version strings.
3. Where IPS/FMWP is in play, confirm virtual patch FG-VD-59270.0day is present as a bridge, not a lifestyle.
4. Restrict who gets admin CLI. Jump hosts, MFA, no shared admin password from a sticky note in 2019.
5. Hunt config and file integrity anomalies on appliances that were vulnerable after April 14 and especially after KEV evidence existed. Forward logs off-box so local delete is less cute.
6. Federal scope: due October 19, 2026. Forensic triage flagged Yes.

Detection ideas without a free PoC

• CMDB drift: builds still in affected ranges after your stated patch SLA
• AAA logs: admin CLI sessions from unfamiliar jump hosts or residential VPN ASNs
• Config commits / file integrity alerts outside change windows on Forti* appliances
• Correlate with other Fortinet KEV history on the same serial numbers (your SIEM already knows which firewalls are drama magnets)

We are not publishing exploit CLI recipes. You do not need them to patch. You need them like you need a second root canal.

The 185-day punchline

April advisory. October KEV. That gap is where “risk-based prioritization” slides go to die. Teams that only patch critical CVSS and internet-unauth RCEs will keep rediscovering that authenticated local/CLI bugs get chained after the first foothold. Fortinet scored it 6.0 with PR:H flavor. CISA still stamped a three-day federal due date once exploitation evidence landed. Your internal SLA should have a column for “vendor said exploited” and “CISA KEV,” not only for the marketing CVSS number on day one.

Sloth take

We spent half a year treating a CLI path traversal like a footnote because the score said medium and the attacker needed admin. Then CISA put it on the calendar next to a BeyondTrust 9.3 and told federal agencies to move by October 19. Patch the trains. Migrate the dead ones. Stop letting CVSS be your only personality.

Want a boring Fortinet inventory mapped to KEV without the webinar? Book Dark Edge Consulting.

How this sits next to the rest of your Fortinet trauma

If your environment still carries scars from prior Forti* KEV seasons, CVE-2025-61624 is not a standalone soap opera. It is another reason the same serial numbers keep appearing in IR notes. Bundle the upgrade: fixed OS train, admin AAA hygiene, off-box logging, and a written rule that “authenticated” vulnerabilities with Known Exploited: Yes do not wait for a critical CVSS rebrand.

Also check FortiPAM and FortiSwitchManager, not only the headline firewall. Advisory tables that list four products are how people patch FortiOS and leave the PAM box as a museum.

Questions for your Fortinet SE that waste less oxygen

1. Confirm exact fixed build for our train and whether 7.2/7.0/6.4 paths are migrate-only for this CVE.
2. Is FG-VD-59270.0day active on our FMWP feed, and what does it actually block?
3. What Fortinet-supported integrity / support-report collection should we pull before and after the upgrade if we suspect prior admin abuse?
4. Any additional KEV items on the same product family we are still below fixed lines for?

Change-management language you can paste

“CISA added CVE-2025-61624 to KEV on 2026-10-16 with due date 2026-10-19 and forensic triage required. Vendor advisory FG-IR-26-122 (2026-04-14) documents authenticated CLI path traversal leading to arbitrary file write/delete on FortiOS/FortiPAM/FortiProxy/FortiSwitchManager. We will upgrade or migrate per the advisory table, verify version strings post-change, review admin CLI access, and retain off-box logs.”

That paragraph beats a Slack thread that says “is 6.0 even real tho.”

Authenticated footholds are still footholds

Every year someone rediscovers that “needs admin” is not a free pass. Ransomware crews and espionage operators collect admin the old-fashioned ways: phishing, password reuse, stolen VPN cookies, prior appliance bugs, MSP tooling abuse. Once they have CLI, a path traversal that writes arbitrary files is a persistence and sabotage primitive. Scoring it medium on day one and KEV on day 185 is how calendars become comedy.

Compare the emotional energy your org spent on unauthenticated edge RCEs versus the energy spent on locking down firewall admin planes. If the second column is empty, CVE-2025-61624 is not a surprise. It is a mirror.

Virtual patch is a bridge, not a personality

Fortinet documents virtual patch FG-VD-59270.0day via FMWP. That can buy hours or days while you schedule the upgrade. It does not migrate FortiOS 7.2 for you. It does not rotate the shared admin password. It does not forward logs off-box. Treat it like a spare tire. Drive to the shop.

Same KEV day as BeyondTrust, different homework

October 16 dumped both CVE-2026-102764 and CVE-2025-61624 into KEV. One is unauthenticated file ops on a remote-support appliance with a Mandiant espionage write-up. The other is authenticated CLI path traversal on Fortinet gear with a six-month-old advisory. Your patching program needs to swallow both without requiring the second to “feel” as exciting as the first. Excitement is not a control.

Admin plane hygiene checklist

• Unique admin accounts, no shared admin password
• Phishing-resistant MFA on AAA that fronts Forti* admin
• Admin access only from jump hosts on a management VRF
• Syslog/CEF off-box with retention past your IR window
• Config backup integrity checks after every change window
• Document which trains are migrate-only so nobody “patches in place” into a fantasy build

Sources

• Fortinet PSIRT FG-IR-26-122 / CVE-2025-61624 (published 2026-04-14; Known Exploited: Yes)
• CISA KEV catalog entry CVE-2025-61624 (added 2026-10-16, due 2026-10-19)
• CISA: “CISA Adds Two Known Exploited Vulnerabilities to Catalog” (Oct 16, 2026)