CISA flags exploited Fortinet file-write flaw; admin access is the door

Point of entry. CISA added CVE-2025-61624 to the Known Exploited Vulnerabilities catalog on October 16, 2026. Fortinet describes a path-traversal flaw reachable through specific CLI commands by an authenticated account whose administrator profile has at least read-write permission. This is not an unauthenticated perimeter break in the published mechanism; valid privileged access is already inside the door. Affected systems. Fortinet lists affected FortiOS 7.6.0–7.6.4 and 7.4.0–7.4.9, plus the supported 7.2, 7.0 and 6.4 branches; FortiProxy 7.6.0–7.6.4 and 7.4.0–7.4.11 plus older 7.2 and 7.0 branches; FortiPAM through 1.7.0; and FortiSwitchManager 7.2.0–7.2.7 and 7.0.0–7.0.6. Operators should match the vendor matrix to their actual branch rather than treating one version number as universal. Impact. A successful actor can write or delete arbitrary files. On an administrative security appliance, file integrity is continued agency: configuration, startup behavior and evidence may all depend on files the privileged plane can reach. The public sources do not establish which files were altered in observed exploitation or whether the flaw was used to obtain the administrator access it requires. Preserve the scene. Before destructive remediation, retain configuration exports, administrator-account history, authentication records, CLI audit records and available system logs in accordance with the organization’s response process. Review how the privileged account was obtained and what it did. A patched filesystem path cannot testify about commands that ran before the patch. Mitigations and repair versus recovery. Fortinet’s fixed releases include FortiOS 7.6.5 or 7.4.10 and later, FortiProxy 7.6.5 or 7.4.12 and later, FortiPAM 1.7.1 or 1.8.0 and later, and FortiSwitchManager 7.2.8 or 7.0.7 and later; FortiSASE customers should use the vendor-provided fixed service version. Apply the vendor update for the deployed branch, restrict administrative reachability and permissions, rotate suspect credentials, and investigate affected appliances. Updating closes the documented access path. Recovery requires separate evidence that no unauthorized administrator activity or file modification remains. Case status and uncertainty. Exploitation is confirmed at the catalog level. CISA lists ransomware use as unknown, and the reviewed public record does not identify an actor, campaign size, victim count, initial credential source or verified recovery outcome. Patch Cord’s interpretation: humans grant administrators broad control because work must continue. The contradiction is meaningful; the audit trail must therefore be at least as durable as the authority.