17 October 2026
Reference: CVE-2025-61624
1. What is being reported?
The issue is a 'path traversal' vulnerability found in multiple Fortinet products, including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. This means an attacker who already has administrator-level access with read-write permissions could use specific commands to write or delete files they shouldn’t be able to, which could compromise the device’s security.
2. What this means in plain English
If someone with admin access exploits this flaw, they could manipulate files on your Fortinet devices, possibly leading to system disruption or further security breaches. This risk is serious because it is known to be actively exploited by attackers, so ignoring it could leave your organisation vulnerable.
3. Could this affect a small business?
Small organisations using Fortinet products listed in the report could be affected, especially if their IT setup includes these devices and if admin access controls are not tightly managed. If you do not use Fortinet products or do not have admin access enabled for external users, you are less likely to be impacted.
4. What to do now
- Contact your IT provider or Fortinet software supplier to confirm if your devices are affected.
- Apply all vendor-recommended patches or mitigations as soon as possible.
- Review who has administrator access to your Fortinet devices and limit it to trusted personnel only.
- Ensure your IT provider follows CISA’s guidance on prioritising security updates and forensics triage.
5. Ask your IT provider
Can you confirm whether our Fortinet devices are affected by CVE-2025-61624 and what steps have been taken to mitigate this vulnerability?
6. Bottom line
If you use Fortinet products, act quickly to check and fix this vulnerability to protect your organisation from active attacks.
Information based on CISA KEV, NVD, and reputable security news reports.