FortiOS Path Traversal Bug Now Exploited: Check Yours

CISA, the federal cybersecurity agency, recently added a FortiOS path traversal flaw (CVE-2025-61624) to its list of actively exploited bugs. That means attackers are using it now, not just in a lab. Fortinet’s own advisory also says it is known to be exploited.

If your office has a Fortinet firewall, this one is worth a look today. It affects FortiOS and a few related Fortinet products. Fixes are available for newer versions.

If you only have the router your internet provider gave you, you can relax. This is about Fortinet gear, which you are more likely to find in an office than in a home.

What the FortiOS path traversal bug does

“Path traversal” is a trick that lets someone reach files they shouldn’t. Think of an office building where a visitor badge opens a door it was never meant to open.

Fortinet says the problem is in the command line interface, the text screen admins use to manage the device. A crafted command can let an attacker write or delete files on the device.

There is a catch. Fortinet describes the attacker as “privileged” and the attack type as “authenticated.” In plain words, the person has to be logged in with some level of admin access first. Fortinet rates it medium severity, with a CVSS score of 6.0. (CVSS is the standard scoring scale for bugs like this.)

That can make it look less scary than it is. We read it this way: a medium bug becomes a real problem when an attacker already has a stolen or weak admin password, or gets in through some other hole. CISA lists it as exploited, and that is the part that matters.

Fortinet first published its advisory (FG-IR-26-122) on April 14, 2026. So fixes have been out for a while. The new part is the confirmation that attackers are using it.

Which versions are affected

Here is the short version of Fortinet’s advisory. “Migrate” means there is no fix inside that older release line, so you have to move to a newer, fixed one.

Product	Affected	Fixed
FortiOS 7.6	7.6.0 through 7.6.4	7.6.5 or above
FortiOS 7.4	7.4.0 through 7.4.9	7.4.10 or above
FortiOS 7.2, 7.0, 6.4	All versions	Migrate to a fixed release
FortiProxy 7.6	7.6.0 through 7.6.4	7.6.5 or above
FortiProxy 7.4	7.4.0 through 7.4.11	7.4.12 or above
FortiProxy 7.2, 7.0	All versions	Migrate to a fixed release
FortiPAM 1.7	1.7.0	1.7.1 or above
FortiPAM 1.6 and older	All versions	Migrate to a fixed release
FortiSwitchManager 7.2	7.2.0 through 7.2.7	7.2.8 or above
FortiSwitchManager 7.0	7.0.0 through 7.0.6	7.0.7 or above

FortiPAM 1.8 is not affected, according to Fortinet. The National Vulnerability Database entry tracks the same CVE.

Fortinet also says a virtual patch is available for people who subscribe to its protection service. That is a stopgap filter, not a replacement for updating.

How to check if you’re affected

Start with a simple question: do you have a Fortinet device? Look for a “FortiGate” label on the box in your network closet. Or ask whoever set up your network.

If you do, log in to the admin page. The dashboard normally shows the firmware version. Compare it to the table above.

If you’re on 7.2, 7.0 or 6.4, there is no patch inside that line. Those versions need a bigger move to a newer release. That is worth planning soon, since firmware that old tends to collect problems. Fortinet has an upgrade tool path listed in its advisory that shows the recommended route from your version to a fixed one.

Don’t update in the middle of a workday. A firewall update restarts the device, and your internet drops for a bit. Pick an evening or weekend.

Why this matters for small offices

Firewalls sit at the front door of your network. When one is weak, everything behind it is easier to reach. Attackers like these devices because few people watch them closely.

Many small offices don’t have anyone checking firewall firmware. Computers get update reminders. Firewalls usually don’t. They can run old software for years without anyone noticing.

We covered common small business security mistakes earlier, and skipped updates are a theme there. Our Cybersecurity category has more of the same. October is Cybersecurity Awareness Month, so it’s a good time for a quick check.

One note on CISA’s deadlines. They bind federal agencies only. But CISA urges everyone else to treat the items on this list as the first things to patch, and we agree.

What to do this week

• Find out if you have Fortinet gear. Check the label on your firewall or ask your installer.
• Check the firmware version and compare it to the table above.
• Schedule the update for after hours if you’re on an affected version. If you’re on 7.2, 7.0 or 6.4, plan the move to a newer release.
• Change admin passwords on the firewall to long, unique ones. Turn on multi-factor sign-in if your device supports it.
• Limit who can reach the admin page. It shouldn’t be open to the whole internet. Keep it to your office network.

If this all sounds like a lot, we’re happy to help. We offer a free 30-minute assessment where we look at your computers, email and backups and tell you what to fix first. No cost, no contract. You can also read about our security services any time.

Sources

• Fortinet PSIRT advisory FG-IR-26-122 (Fortinet)
• NVD entry for CVE-2025-61624 (National Institute of Standards and Technology)

This article was drafted by Percival, Rainier IT’s AI writing assistant, from the sources linked above, and reviewed by Christopher Engelhardt before publication. Spot an error? Email [email protected].