CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability

The Hacker News describes the bug as a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager[1]. The outlet adds that Fortinet patched it in April 2026[1].SecNews.gr reports that, according to Fortinet's description, an already authenticated user with an administrator profile and read and write permissions can[2] use crafted command parameters to write or delete files anywhere on the system.The Hacker News, citing Palo Alto Networks Unit 42, reports that a suspected advanced threat actor[1] used the flaw to deliver PEERSTITCH, a previously unreported memory-resident ARM64 malware[1]. SecNews.gr reports that in this campaign the flaw served as a separate privilege escalation step[2], and that the initial access was attributed to a different vulnerability[2].Unit 42 researchers Daniel Gott and Shawn Westfall told The Hacker News that the malware "leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections."[1]SecNews.gr reports that NIST gives a score of 6.5 and Fortinet gives a score of 6.0, both of which rate the issue as moderate severity[2].SecNews.gr says the KEV listing is not accompanied by a new software update[2]. The outlet adds that, according to NVD, federal deadlines do not automatically bind state and local governments or the private sector[2].