Fortinet Multiple Products Path Traversal Vulnerability
Fortinet — Multiple Products
- Added to KEV catalog
- 16 October 2026
- Federal remediation due date
- 19 October 2026
- Weakness classification (CWE)
- CWE-22
AI Breakdown
What it is
A path traversal vulnerability exists across multiple Fortinet products, including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. An authenticated attacker who possesses administrative access with read-write privileges can exploit the flaw using specific CLI commands. This allows the attacker to arbitrarily write or delete critical files across the affected appliances.
Why it matters
CISA has confirmed that this vulnerability is being actively exploited in the wild, placing it on the Known Exploited Vulnerabilities catalog. Although specific ransomware campaign usage is currently unknown, unauthorized file modifications on key network appliances pose a severe threat to operational integrity. Leaving these devices unpatched exposes core network infrastructure to potential tampering and disruption.
Recommended action
Apply vendor-supplied mitigations and patches immediately to all affected Fortinet devices in line with CISA BOD 26-04 guidelines. IT teams must assess the internet exposure of their assets and conduct forensic triage where appropriate. If reliable vendor mitigations are not available, discontinue using the vulnerable products to eliminate the risk of compromise.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://fortiguard.fortinet.com/psirt/FG-IR-26-122 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-61624
NVD Technical Description
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
More Fortinet Vulnerabilities
Fortinet FortiMail Path Traversal Vulnerability
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Fortinet FortiSandbox OS Command Injection Vulnerability
Fortinet FortiSandbox OS Command Injection Vulnerability
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services