Admin-Only Fortinet Flaw CVE-2025-61624 Used to Gain Root, Now on CISA KEV

CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on 16 October 2026, with a federal deadline of 19 October. The flaw is a path traversal in the command-line interface of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. Fortinet published it on 14 April 2026 as FG-IR-26-122 and rates it Medium, CVSS 6.0. The advisory now marks the bug as known exploited. Unpatched devices on any of the four products are affected, and the risk is highest where administrator credentials may already have leaked.

Why a medium bug made the list

The score reflects what an attacker needs first. Fortinet's vector is local, with high privileges required, and CISA's entry says the attacker needs an admin profile with at least read-write permissions. Fortinet says crafted arguments to existing CLI commands let such an attacker write or delete arbitrary files. Fortinet found the flaw internally.

Palo Alto Networks Unit 42 showed what that is worth once an attacker is already in. In its 14 October report on the PEERSTITCH implant, Unit 42 says the attackers used CVE-2025-61624 to go from FortiOS administrator access to root on the firewall.

Fortinet published the advisory in April 2026; Unit 42 tied the flaw to PEERSTITCH and CISA added it to KEV in October.

How it was used

According to Unit 42, the name of an auto-script object in the system.auto-script engine is not sanitized. A name containing traversal sequences places the script body at an arbitrary path, and the script runs with the engine's privileges. The attackers used two such objects:

• ../../../../setup to drop the PEERSTITCH initial-stage loader.
• ../../tmp/apache2/conf/md-acme.conf to set up a reverse-shell channel through Apache mod_md.

Afterwards they deleted the rogue admin accounts, VPN groups and auto-script objects.

Unit 42 tracks the campaign as CL-STA-0954 (also UNC5820). It began in September 2024 at a telecom managed service provider, through the FortiManager flaw CVE-2024-47575, and the attackers stole configurations, credentials and certificates for more than 500 managed FortiGates.

Unit 42 does not say when CVE-2025-61624 was exploited, and it does not say how the attackers obtained the admin access the traversal needs. Separately, Unit 42 documents the attackers recovering admin and SSL VPN passwords by brute-forcing reversible ciphertext in stolen configurations, but it does not connect that to this flaw. The implant itself is covered in our earlier article, PEERSTITCH: A Memory-Only FortiGate Implant Built on the 2024 FortiManager Breach.

Affected and fixed versions

Per FG-IR-26-122:

Fortinet lists no workaround. It offers a virtual patch, FG-VD-59270.0day, in FMWP database update 25.120. HKCERT's 20 October bulletin gives the same affected products.

What defenders should do

• Upgrade to the fixed builds above. Where the branch has no fix (FortiOS 7.2, 7.0 and 6.4), plan a migration; the virtual patch is the only stopgap Fortinet names.
• Patching does not remove an implant that is already in place. CISA flags this entry for forensic triage, and its required action cites BOD 26-04.
• Hunt for signs of use. Unit 42 advises checking FortiOS configuration revisions for system.auto-script objects whose names contain ../../, and checking crash logs for segmentation faults in miglogd, iked or syslogd.
• If a FortiManager or other management platform was exposed, treat the credentials and certificates it held as compromised and rotate them, as Unit 42 advises.
• Review who holds read-write admin profiles, since that is the entry condition.

CISA lists ransomware use as unknown.

Sources

• Fortinet PSIRT FG-IR-26-122
• CISA Known Exploited Vulnerabilities catalog (JSON feed)
• HKCERT security bulletin, 20 Oct 2026
• Palo Alto Networks Unit 42, PEERSTITCH research
• The Hacker News, 16 Oct 2026