Path Traversal Vulnerability in Fortinet Network Security Products

Catalog analysis: CISA added this entry on October 16, 2026. The entry reflects catalog information retrieved on October 16, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-61624 is a path traversal vulnerability (CWE-22) identified in multiple Fortinet products. This flaw allows an attacker who has already authenticated with an administrative profile and possesses at least read-write permissions to use specific Command Line Interface (CLI) commands to write or delete arbitrary files on the system.

Exposure and applicability

This vulnerability affects several components often used in healthcare infrastructure to secure network perimeters and manage access, including:
* FortiOS
* FortiPAM
* FortiProxy
* FortiSwitchManager

For U.S. healthcare providers and business associates, these devices frequently serve as the primary defense for environments containing electronic Protected Health Information (ePHI). While this vulnerability requires administrative authentication—meaning it is not an unauthenticated remote entry point—it represents a significant risk to the integrity and availability of security appliances. If an administrative account is compromised or if internal privilege escalation occurs, an attacker could potentially disrupt patient care continuity by deleting critical system files or modifying configuration data.

Remediation priorities

Our analysis suggests that healthcare IT and security leaders prioritize the following actions based on the risk to clinical operations:

1. Immediate Patching: Apply vendor-supplied mitigations for all affected Fortinet appliances. Given that CISA has added this to its Known Exploited Vulnerabilities catalog, patching should be prioritized over standard maintenance cycles.
2. Administrative Access Review: Audit all accounts with administrative profiles. Ensure the principle of least privilege is applied so that only essential personnel have read-write permissions on these devices.
3. Credential Rotation: As a precautionary measure following patching, rotate credentials for administrative accounts to reduce the risk of existing compromised sessions being used to exploit the flaw.

How to validate remediation

To verify that exposure has been reduced, security teams should perform the following checks:
* Version Verification: Confirm that the installed firmware version on all FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager devices matches or exceeds the vendor’s patched release.
* Permission Audit: Review the current administrative profile assignments to ensure no unauthorized users possess the read-write permissions required for this exploit path.

Note: Version checks alone do not guarantee total security, but they confirm the application of the specific fix for CVE-2025-61624.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in ransomware campaigns. Additionally, while patching addresses the path traversal flaw, it does not eliminate the risk posed by compromised administrative credentials themselves. Organizations should recognize that residual risk remains if administrative access is not strictly controlled via multi-factor authentication (MFA) and rigorous logging.

Source and editorial note

CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability · Source date: October 16, 2026 · Retrieved October 16, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a healthcare security assessment