Security teams using Fortinet infrastructure need to be aware of a recently disclosed path traversal vulnerability affecting several products. This issue involves how specific administrative commands handle file paths, potentially introducing significant security risks to corporate networks if left unaddressed.

Tracked as CVE-2025-61624, this high-severity security flaw requires prompt attention from IT administrators and security managers.

What Happened

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability. This flaw may allow an authenticated attacker who holds an admin profile with at least read-write permissions to write or delete arbitrary files through specific Command Line Interface (CLI) commands.

Furthermore, this issue is officially listed on CISA's Known Exploited Vulnerabilities (KEV) list, which means active exploitation has been observed in the wild. This designation elevates the urgency for organizations utilizing these platforms to review their security posture immediately.

Who Should Care

Small and medium-sized businesses, enterprise IT teams, and managed service providers using Fortinet solutions must take note. Because the vulnerability requires administrative access with read-write permissions, organizations should pay close attention to internal user privileges and account security.

Even though an attacker needs specific administrative access to leverage this flaw, compromised admin credentials or insider threats could turn this path traversal issue into a serious system integrity problem. Securing administrative accounts and enforcing strict access controls are vital components of mitigating this risk.

What To Do Now

If your organization relies on Fortinet products, take immediate action to secure your environment:

  • Review Administrative Access: Audit your admin profiles and ensure that only authorized personnel hold read-write permissions.
  • Apply Vendor Updates: Check the official Fortinet advisory details for guidance on patches and remediation steps provided by the vendor.
  • Monitor Logs: Keep a close eye on CLI command executions and administrative activity for any unusual file modification patterns.

Maintaining visibility into your network security helps catch issues early before they impact business operations.

Run a free external vulnerability and security check on your perimeter today by visiting Korisec.