CVE-2025-61624Vulnerability
Fortinet Multiple Products Path Traversal Vulnerability
Reported by 5 independent sources · first reported by Palo Alto Unit 42 · last reported
Last reported 5 days ago
Fix due 19 Oct 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 64% of CVEsFIRST EPSS, as of 24 Oct 2026
What the reports say
7 reports, newest first · the exact sentence from each-
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More“…Next.js), CVE-2026-108097, CVE-2026-108099 (Drupal), CVE-2026-15911 (confluent-kafka), CVE-2026-102764 (BeyondTrust Remote Support), CVE-2025-61624 (Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager), CVE-2026-104935 (Ivanti Connect Secure), and multiple vulnerabilit…”
-
Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack“A fresh report from Palo Alto Networks shows that UNC5820 also exploited CVE-2025-61624, a path traversal vulnerability affecting multiple Fortinet products, as part of the same intrusion.”
-
U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog“CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability”
-
CISA Adds Two Known Exploited Vulnerabilities to Catalog“CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability”
-
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager“In the second stage, attackers exploited CVE-2025-61624, a path traversal flaw in the FortiOS auto-script engine, to deploy a new implant called PEERSTITCH.”
-
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions“The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a privileged attacker to achieve arbitrary write or delete files via specifica…”
-
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant“The attackers exploited another vulnerability, CVE-2025-61624, via FortiOS auto-script path traversal.”
Indicators reported together
named in the same reports- 23.240.77[.]233in 2 reports
Copy this indicator · defanged
Also named with it: CVE-2024-47575, CVE-2024-26008, CVE-2026-102764, CVE-2024-26009, CVE-2026-34073, CVE-2021-36260, CVE-2026-83498, CVE-2026-74580, CVE-2026-79724, CVE-2026-85025, CVE-2026-81204, CVE-2026-103947, CVE-2026-103946, CVE-2026-106126, CVE-2026-14814, CVE-2026-16301, CVE-2026-92883, CVE-2026-97229, CVE-2026-85947
Thanks — we review every report.