Fortinet released patches for multiple critical vulnerabilities across 14 products
Fortinet released patches for multiple critical vulnerabilities across 14 products; CVE-2025-61624 is actively exploited, enabling arbitrary code execution.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 26 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-61624 and CVE-2026-39808 as exploited in the wild.
Fortinet disclosed multiple vulnerabilities affecting a broad range of its enterprise security products, including FortiOS, FortiManager, FortiAnalyzer, and twelve other platforms. The most severe flaws include heap-based buffer overflows, OS command injection, SQL injection, and path traversal vulnerabilities that could enable unauthenticated remote code execution. CVE-2025-61624, a path traversal flaw in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, has been exploited in the wild and allows privileged attackers to write or delete arbitrary files.
The vulnerabilities span initial access vectors (exploitation of public-facing applications) and post-compromise abuse of privileged functions. Several flaws require no authentication (CVE-2026-22828, CVE-2026-39808, CVE-2026-39813), while others demand authenticated access but still pose significant risk due to the privileged nature of affected services. Successful exploitation could result in full system compromise, data exfiltration, or denial of service across network management, endpoint security, and unified threat management platforms.
Organizations running affected Fortinet products face immediate risk and should prioritize patching, particularly for internet-facing instances. The breadth of affected products and the confirmed exploitation of at least one vulnerability indicate active threat-actor interest in this attack surface. MS-ISAC recommends emergency patching, network segmentation, and least-privilege enforcement to mitigate exposure.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-035
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs