Fortinet path traversal flaw CVE-2025-61624 exploited
Fortinet disclosed dozens of vulnerabilities across its product line, including a CLI path traversal bug (CVE-2025-61624) that is being actively exploited in the wild.
CISA/MS-ISAC issued an advisory covering a large batch of Fortinet vulnerabilities spanning FortiAnalyzer, FortiClientEMS, FortiDDoS, FortiManager, FortiNAC-F, FortiNDR, FortiOS, FortiPAM, FortiProxy, FortiSandbox, FortiSOAR, FortiSwitchManager, FortiVoice, and FortiWeb. The most severe issues include a heap-based buffer overflow in FortiAnalyzer Cloud's oftpd daemon, OS command injection in FortiSandbox, and SQL injection flaws in FortiClientEMS and FortiDDoS-F, several of which are remotely exploitable without authentication and could lead to arbitrary code execution.
Fortinet has confirmed that CVE-2025-61624, a path traversal vulnerability in the CLI of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, is being actively exploited in the wild, allowing a privileged attacker to arbitrarily write or delete files. The remaining vulnerabilities range from authentication bypass and hard-coded cryptographic keys to cross-site scripting, SSRF, and information disclosure issues, most requiring authenticated or privileged access. Given the breadth of affected products, the presence of at least one actively exploited CVE, and unauthenticated RCE-class bugs in FortiAnalyzer and FortiSandbox, organizations running these products should prioritize patching immediately.
MS-ISAC recommends applying Fortinet's stable channel updates without delay, enforcing least-privilege on service accounts, segmenting management interfaces from the internet, and conducting regular vulnerability scanning and penetration testing against externally exposed Fortinet assets.
Mentioned in this report
Detection guidance
Fortinet CLI Path Traversal File Write Attempt
Detects suspicious file write operations via Fortinet CLI commands exploiting CVE-2025-61624 path traversal, using ../ or absolute path traversal patterns in file operation arguments. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Fortinet CLI Path Traversal File Write Attempt
description: Detects path traversal attempts in Fortinet CLI (FortiOS, FortiPAM, FortiProxy,
FortiSwitchManager) via file write commands with directory traversal sequences or
absolute paths outside intended directories. Targets CVE-2025-61624 exploitation.
tags:
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \fortios.exe
- \fortipam.exe
- \fortiproxy.exe
- \fortiswitchmanager.exe
CommandLine|contains:
- ../
- ..\\
- write
- copy
- move
path_traversal:
CommandLine|re: (\.\.[\\/]){2,}|/etc/|/root/|C:\\Windows\\|C:\\Program Files
condition: selection and path_traversal
falsepositives:
- Legitimate backup or migration scripts using relative paths in Fortinet CLI
level: high
id: e6d0922a-f6c0-5510-8cb7-d5049df1aa86
status: experimental
author: Vorant
Fortinet Daemon Unusual Network Activity Post-Exploitation
Detects network connections from Fortinet daemon processes (oftpd, sandboxd, ndrd) to unexpected external hosts, potentially indicating post-exploitation command-and-control or data exfiltration following buffer overflow or injection attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Fortinet Daemon Unusual Network Activity Post-Exploitation
description: Detects network connections initiated by Fortinet background daemons
(oftpd, sandboxd, ndrd from FortiAnalyzer, FortiSandbox, FortiNDR) to non-standard
ports or external IPs, consistent with post-exploitation C2 or data exfiltration
following RCE via CVE-2025-61624 or related heap-overflow/injection flaws.
tags:
- attack.t1190
- attack.execution
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith:
- \oftpd.exe
- \sandboxd.exe
- \ndrd.exe
filter_internal:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
filter_dns:
DestinationPort: 53
filter_ntp:
DestinationPort: 123
filter_fortinet_repo:
DestinationHostname|contains:
- fortinet.com
- fortiupdate.com
condition: selection and not (filter_internal or filter_dns or filter_ntp or filter_fortinet_repo)
falsepositives:
- Fortinet cloud-based analytics or telemetry connections to Fortinet infrastructure
- Legitimate third-party integration endpoints configured in Fortinet management console
level: medium
id: be86c95d-8c5b-5b9f-9a83-c76fde34a3e6
status: experimental
author: Vorant
Fortinet Management Interface Authentication Bypass or Privilege Escalation
Detects suspicious HTTP/HTTPS requests to Fortinet management interfaces (ports 80, 443, 8080, 8443) with authentication bypass patterns or privilege escalation payloads in URI, referencing CVE-2025-61624 and related auth bypass flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Fortinet Management Interface Authentication Bypass or Privilege Escalation
description: Detects HTTP requests to Fortinet management interfaces attempting authentication
bypass or privilege escalation via path traversal or hardcoded credential exploitation
in URI or headers, targeting CVE-2025-61624 and related authentication flaws in
FortiManager, FortiAnalyzer, FortiClientEMS, and FortiPAM.
tags:
- attack.t1190
- attack.initial-access
logsource:
category: proxy
product: fortinet
detection:
selection_mgmt_port:
DestinationPort:
- 80
- 443
- 8080
- 8443
selection_mgmt_path:
Url|contains:
- /admin/
- /api/
- /system/
- /config/
selection_traversal:
Url|contains:
- ../
- ..%2F
- ..;
selection_bypass_pattern:
Url|re: (bypass|authenticate|login|token|session|admin|root|privilege).*?(=|%3D)
filter_internal_source:
SourceIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: (selection_mgmt_port and selection_mgmt_path) and (selection_traversal
or selection_bypass_pattern) and not filter_internal_source
falsepositives:
- Legitimate Fortinet management automation from authorized admin workstations or
jump hosts
- Vulnerability scanners configured to scan Fortinet management interfaces during
authorized pentest windows
level: high
id: ee7b4fcd-ca6c-555e-80d1-d4d1916953ed
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-035
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free