CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability

CISA says it has added CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability[2] to its Known Exploited Vulnerabilities catalog. The Hacker News reports that the addition came on October 16, 2026, requiring federal agencies to apply the fixes by October 19, 2026.[1]According to the Center for Internet Security, the flaw sits in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager[3] and lets a privileged attacker write or delete arbitrary files. The Hacker News reports that the bug was patched by Fortinet in April 2026.[1]SentinelOne says that exploiting the flaw requires an admin profile and at least read-write permissions[4]. Sources disagree on how severe it is: Tenable lists a CVSS 3.1 score of 6.5, rated Medium[5], while The Hacker News cites CVSS score: 5.4[1].According to The Hacker News, the attackers used stolen information to set up unauthorized FortiGate SSL/VPN sessions and exploit a separate privilege-escalation vulnerability (i.e., CVE-2025-61624) to deploy PEERSTITCH.[1]Palo Alto Networks Unit 42 researchers Daniel Gott and Shawn Westfall told The Hacker News that "PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections."[1]SentinelOne advises administrators to consult the Fortinet Security Advisory FG-IR-26-122 for specific patched versions[4] and to review CLI audit logs for signs of exploitation.