CISA, the federal cybersecurity agency, recently added a FortiOS path traversal flaw (CVE-2025-61624) to its list of actively exploited bugs. That means attackers are using it now, not just in a lab. Fortinet’s own advisory also says it is known to be exploited.<\/p>\n\n\n\n
If your office has a Fortinet firewall, this one is worth a look today. It affects FortiOS and a few related Fortinet products. Fixes are available for newer versions.<\/p>\n\n\n\n
If you only have the router your internet provider gave you, you can relax. This is about Fortinet gear, which you are more likely to find in an office than in a home.<\/p>\n\n\n\n
“Path traversal” is a trick that lets someone reach files they shouldn’t. Think of an office building where a visitor badge opens a door it was never meant to open.<\/p>\n\n\n\n
Fortinet says the problem is in the command line interface, the text screen admins use to manage the device. A crafted command can let an attacker write or delete files on the device.<\/p>\n\n\n\n
There is a catch. Fortinet describes the attacker as “privileged” and the attack type as “authenticated.” In plain words, the person has to be logged in with some level of admin access first. Fortinet rates it medium severity, with a CVSS score of 6.0. (CVSS is the standard scoring scale for bugs like this.)<\/p>\n\n\n\n
That can make it look less scary than it is. We read it this way: a medium bug becomes a real problem when an attacker already has a stolen or weak admin password, or gets in through some other hole. CISA lists it as exploited, and that is the part that matters.<\/p>\n\n\n\n
Fortinet first published its advisory (FG-IR-26-122) on April 14, 2026. So fixes have been out for a while. The new part is the confirmation that attackers are using it.<\/p>\n\n\n\n
Here is the short version of Fortinet’s advisory<\/a>. “Migrate” means there is no fix inside that older release line, so you have to move to a newer, fixed one.<\/p>\n\n\n\n