CVE-2025-61624 – Fortinet Path Traversal Enables Arbitrary File Write/Delete in FortiOS and Multiple Products

TL;DR

• CVE-2025-61624 is a path traversal (CWE-22) flaw in Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that allows an authenticated admin with read-write permissions to write or delete arbitrary files.
• Rated Medium severity (CVSS 6.5 NIST / 6.0 Fortinet), but added to the CISA KEV on 2026-10-16 due to active exploitation in the wild.
• Attackers are chaining this with CVE-2024-47575 (FortiManager) to steal credentials across hundreds of firewalls, escalate to root, and deploy the fileless PEERSTITCH implant.
• Federal remediation deadline: 2026-10-19. All affected appliances must be patched or taken offline immediately.
• Key action: upgrade to fixed releases and rotate all managed-device credentials and keys — patching alone is not enough.

Overview

CVE-2025-61624 is a path traversal vulnerability (CWE-22) affecting multiple Fortinet products, including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. The flaw permits an authenticated attacker with an administrator profile and at least read-write permissions to write or delete arbitrary files on the underlying system through specific CLI commands.

On October 16, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-61624 to its Known Exploited Vulnerabilities (CISA KEV) catalog, confirming that the vulnerability is being actively exploited in the wild. The inclusion carries a federal remediation deadline of October 19, 2026, and triggers mandatory forensic triage requirements for U.S. federal agencies under Binding Operational Directive (BOD) 26-04.

Technical Details

The vulnerability resides in the CLI handling of affected Fortinet appliances. An attacker who has already obtained administrative access — typically through credential theft or a separate initial-access vulnerability — can craft specific CLI commands that include path traversal sequences (e.g., ../).

Because the vulnerable code fails to properly sanitize or restrict the destination path, the attacker can:

• Write arbitrary files to locations outside the intended directory, potentially planting malicious binaries, configuration files, or persistence mechanisms.
• Delete arbitrary files, which can be used to disable logging, remove forensic artifacts, or disrupt services.

The CVSS 3.1 vector string published by NIST is:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

This reflects a network-accessible attack with low complexity, but requiring high privileges (authenticated admin) and no user interaction. The integrity and availability impacts are high, while confidentiality is not directly impacted.

Notably, Fortinet's own PSIRT rates the vulnerability lower (CVSS 6.0) with an attack vector of Local (AV:L), reflecting their assessment that the exploit requires an on-box or already-authenticated session. The discrepancy between the two scores is significant: a Medium base score can lead organizations to deprioritize the flaw in traditional patch-management workflows — which is exactly what happened in the documented attack chain.

Severity & Impact

Despite the Medium rating, the real-world impact is severe when chained with initial-access flaws. In the documented campaign, attackers used CVE-2025-61624 to escalate from compromised admin credentials to root-level control of FortiGate firewalls, enabling deployment of the fileless PEERSTITCH implant across more than 500 devices.

Affected Products

The vulnerability spans a broad range of Fortinet products and versions:

• FortiOS — 7.6.0–7.6.4, 7.4.0–7.4.9, 7.2 (all), 7.0 (all), 6.4 (all)
• FortiPAM — 1.7.0, 1.6 (all), 1.5 (all), 1.4 (all), 1.3 (all), 1.2 (all), 1.1 (all), 1.0 (all)
• FortiProxy — 7.6.0–7.6.4, 7.4.0–7.4.11, 7.2 (all), 7.0 (all)
• FortiSwitchManager — 7.2.0–7.2.7, 7.0.0–7.0.6
• Siemens Ruggedcom APE1808 (firmware)

For the complete list of affected products, versions, and CPE data, see the VulnSocial CVE page.

Active Exploitation & Threat Context

This is not a theoretical vulnerability. CVE-2025-61624 is being actively exploited in targeted campaigns, and the threat activity has intensified sharply since its addition to the CISA KEV.

Key threat intelligence from multiple sources:

• Initial access via FortiManager: Attackers first exploited CVE-2024-47575, a FortiManager vulnerability, to register a rogue device on a management console. From there, they exfiltrated configuration archives containing credentials, private encryption keys, and network maps for 500+ firewalls.
• Credential escalation: The stolen passwords were in a recoverable format and were successfully cracked, allowing attackers to authenticate through each firewall's VPN with legitimate credentials.
• Root escalation: CVE-2025-61624 was then used to escalate from admin to full operating-system control, enabling arbitrary file write and deletion.
• PEERSTITCH implant: The ultimate payload was a fileless rootkit that injected into the firewall's logging and VPN services, deleted its own binary from disk, and hijacked the certificate renewal module as a command-and-control channel — leaving no file, no open port, and no outbound connection to detect.

For a detailed view of exploit activity over time, mention counts, and signal data, see the CVE page on VulnSocial.

Why the Medium Score Is Misleading

The documented attack chain demonstrates that CVE-2025-61624 functions as a post-compromise privilege escalation primitive. When combined with stolen credentials or an initial-access flaw, it converts limited admin access into full root control. Organizations that rely solely on severity-based patch prioritization may deprioritize this flaw — and that is precisely the gap attackers exploited.

Actionable Insights for Defenders

What to Monitor

• Admin CLI activity: Watch for CLI commands containing path traversal sequences (../, ..\, absolute paths) on FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager appliances.
• Certificate renewal anomalies: Monitor whether the built-in certificate renewal module is reaching unexpected destinations — this was the PEERSTITCH implant's C2 channel.
• VPN service behavior: Unexplained changes in how the VPN service handles sessions, including bypasses of normal security checks.
• MSP-managed environments: Treat the FortiManager management plane as a blast-radius multiplier. A single compromised console can expose credentials for every managed device.

What Changed Recently

• 2026-10-16: CISA KEV addition triggered a sharp spike in exploitation mentions (18 in a single day) and expanded forensic triage requirements.
• 2026-10-17: Unit 42 published detailed analysis of the PEERSTITCH campaign, confirming the full attack chain from FortiManager compromise to root-level implant deployment.
• 2026-10-19: Federal remediation deadline. Organizations with exposed appliances must have mitigations in place by this date.

Remediation & Mitigation

Follow these steps in order:

1. Patch immediately — Upgrade to the fixed releases:

   • FortiOS: 7.6.5 or 7.4.10
   • FortiProxy: 7.6.5 or 7.4.12
   • FortiPAM: 1.7.1
   • FortiSwitchManager: 7.2.8 or 7.0.7
   • If running FortiOS 7.2, 7.0, or 6.4, migrate to a fixed release — these branches have no direct patch.

2. Rotate all credentials and keys — Patching alone is insufficient. Assume any credential or encryption key that existed on a compromised FortiManager console or managed firewall is exposed. Rotate passwords, private keys, and certificate trust material across every managed device.

3. Audit admin accounts and auto-script objects — Review all administrative accounts for unauthorized changes, and inspect auto-script objects for path traversal patterns (../).

4. Hunt for PEERSTITCH indicators — File and signature-based detection will not find this implant. Focus on behavioral anomalies:

   • Certificate renewal traffic to unexpected destinations
   • VPN sessions that bypass normal security checks
   • Unexplained traffic patterns not matching firewall configuration

5. Isolate if unable to patch — If an affected appliance cannot be upgraded immediately, disconnect it from the network or restrict administrative access to trusted management hosts only.

6. Apply forensic triage — For U.S. federal agencies, CISA mandates forensic triage for this vulnerability under BOD 26-04. Check for signs of compromise, not just verify patch status.

References

• CISA KEV — CVE-2025-61624
• Fortinet PSIRT — FG-IR-26-122
• Siemens — SSA-975644
• Unit 42 — PEERSTITCH Malware Analysis
• VulnSocial — CVE-2025-61624

Bottom Line

CVE-2025-61624 is a Medium-rated path traversal flaw in Fortinet products that is being actively exploited to escalate to root and deploy fileless malware. Its presence in the CISA KEV and the October 19 federal deadline make it a priority for immediate patching, credential rotation, and forensic review — especially in MSP-managed environments where a single compromised console can expose hundreds of firewalls.

#CVE202561624 #Fortinet #FortiOS #CISAKEV #PathTraversal #CWE22 #PEERSTITCH #FortiGate #FortiProxy #FortiPAM #FortiSwitchManager #ActiveExploitation #KEV #CVE #InfoSec #CyberSecurity