Swiss SME Cyber Alert: FortiGate – actively exploited admin flaw enables root access
FortiGate firewalls are widely used by small and medium-sized businesses, either directly or through an IT provider. CISA added CVE-2025-61624 to its exploited-vulnerabilities catalogue on 16 October 2026; the flaw can allow an already privileged FortiOS administrator to gain root control of the device.
This is not an unauthenticated attack. If your business uses FortiGate, ask your IT provider to check the FortiOS version, privileged access and potential signs of compromise now.
What happened?
Fortinet describes CVE-2025-61624 as a path-traversal flaw in the command-line interface of FortiOS and other products. An authenticated attacker with a privileged administrator account and write permissions can use it to write or delete arbitrary files.
On 14 October 2026, Unit 42 published details of an investigated intrusion. After an earlier FortiManager compromise and access to valid credentials, the attackers used CVE-2025-61624 to escalate from restricted FortiOS administration to root and deploy the memory-resident PEERSTITCH implant. CISA added the vulnerability to its KEV catalogue on 16 October 2026.
Could my business be affected?
Yes, if your business or IT provider operates FortiGate firewalls on an affected FortiOS release. Affected versions are FortiOS 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, and all releases in the 7.2, 7.0 and 6.4 branches. FortiPAM, FortiProxy and FortiSwitchManager are also affected; the precise version ranges are listed in Fortinet’s advisory.
Exploitation requires an existing privileged administrator account. The review is therefore particularly important for firewalls managed centrally through FortiManager or by an external IT provider, and where suspicious admin logins or earlier Fortinet incidents have occurred.
What should you do now?
Ask your IT provider today to carry out an inventory, version check and compromise assessment. FortiOS 7.6 should be updated to at least 7.6.5, and FortiOS 7.4 to at least 7.4.10. Systems on 7.2, 7.0 or 6.4 must be migrated to a fixed, supported release in line with Fortinet’s guidance.
Privileged accounts, central management paths and event logs should also be checked for unusual changes. If FortiManager, administrator credentials or cryptographic trust material may have been exposed, a firmware update alone is not enough: an incident-response investigation and controlled rotation of affected credentials, keys and certificates are required.
How urgent is it?
High for affected FortiGate systems, particularly where central management is used or there are signs of abused admin access. The flaw has a medium CVSS score of 5.4, but it is demonstrably being used in real attacks to escalate to root. It is not a standalone unauthenticated attack; the attacker must already have privileged FortiOS access.
Information for your IT provider
CVE-2025-61624, CWE-22, CVSS v3.1: 5.4. Attack path: authenticated, privileged FortiOS administrator with at least write permission → path traversal in system.auto-script or existing CLI commands → arbitrary file write or deletion as root.
Fixed FortiOS branches: 7.6.5 or later and 7.4.10 or later; older affected branches must be migrated to a fixed release. For FortiProxy, use 7.6.5 or later or 7.4.12 or later; for FortiPAM, 1.8.0 or later or 1.7.1 or later; and for FortiSwitchManager, 7.2.8 or later or 7.0.7 or later. Include Unit 42’s PEERSTITCH indicators and detection guidance in the compromise assessment.
