CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on 16 October 2026. Fortinet already marks the flaw as exploited. The score is modest. The product list is not.
What happened
Fortinet published FG-IR-26-122 on 14 April 2026. A path traversal in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager lets a privileged attacker write or delete arbitrary files by feeding crafted arguments to existing commands. The attacker needs an admin profile with at least read-write rights. This is not an unauthenticated internet bug.
The CVE record scores it 5.4 (CVSS 3.1). Fortinet lists a base score of 6.0 and a temporal score of 5.4, and sets Known Exploited to Yes. CISA's 16 October alert names the same CVE, with a US federal due date of 19 October 2026. A virtual patch, FG-VD-59270.0day, is in FortiManager database update 25.120. That is a stopgap, not a firmware fix.
Who is affected
- FortiOS 7.6.0 through 7.6.4. Upgrade to 7.6.5 or later.
- FortiOS 7.4.0 through 7.4.9. Upgrade to 7.4.10 or later.
- FortiOS 7.2, 7.0 and 6.4, all versions. No fix on those branches. Migrate to a fixed release.
- FortiProxy 7.6.0 through 7.6.4 (fix 7.6.5 or later) and 7.4.0 through 7.4.11 (fix 7.4.12 or later). FortiProxy 7.2 and 7.0 must migrate.
- FortiSwitchManager 7.2.0 through 7.2.7 (fix 7.2.8 or later) and 7.0.0 through 7.0.6 (fix 7.0.7 or later).
- FortiPAM 1.7.0 (fix 1.7.1 or later). FortiPAM 1.0 through 1.6 must migrate. FortiPAM 1.8 is not affected.
What to do now
Check the firmware on every FortiGate, then upgrade the branches that have a fix and plan a migration for the ones that do not.
- On each firewall run get system status, or open System, Dashboard, and record the version. Do the same for FortiProxy, FortiPAM and FortiSwitchManager.
- Upgrade FortiOS 7.6 to 7.6.5 or later, and 7.4 to 7.4.10 or later, using Fortinet's upgrade path. Do not jump branches in one step.
- If you are still on 7.2, 7.0 or 6.4, there is no patch. Move to 7.4.10 or 7.6.5.
- Review admin accounts, auto-scripts and unexpected CLI changes. A stolen admin password is the way in. Resetting firmware later does not revoke credentials already copied.
- If FortiManager manages the fleet, confirm it is patched for older management flaws and that the virtual patch database is current while you schedule the firmware window.
What this means for South African businesses
FortiGate is common on South African SME networks, and a lot of those boxes are still on 7.2 or 7.0 because the last upgrade was painful. Those branches have no fix. An attacker who already has an admin login, from a reused password or a managed-firewall console, can write files the web interface will never show you. Patching after that does not remove what was written.
Source: Fortinet PSIRT FG-IR-26-122. CISA listed the CVE as exploited on 16 October 2026.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.