FortiOS CLI path traversal CVE-2025-61624: exploited to gain root

CVE-2025-61624 needs an administrator login, which is why Fortinet rates it medium. Unit 42's account of a real intrusion shows what that leaves out. A FortiOS administrator, even a super_admin, works inside a restricted command line with no shell, while the daemons underneath run as root. This bug lets an administrator write files anywhere on the appliance, and attackers used it to turn admin access into root and load a memory-resident implant called PEERSTITCH.

Fortinet found the flaw internally and published advisory FG-IR-26-122 on 14 April 2026, already marked as known exploited but with no detail. The CVE number dates from September 2025, when Fortinet reserved it. On 14 October 2026 Unit 42 published its investigation of a telecom provider breach, and CISA added the CVE to its Known Exploited Vulnerabilities catalog two days later, giving federal agencies until 19 October and requiring forensic triage.

Who is affected

The flaw is in the command line interpreter of four Fortinet product lines:

Siemens lists its RUGGEDCOM APE1808, which runs FortiGate NGFW, as affected below NGFW 7.4.10. The solution text in Fortinet's CVE record also mentions FortiSASE, fixed by Fortinet in 25.4.b, and FortiSwitch, but neither appears in the advisory's affected table.

The attacker needs an authenticated account with an admin profile and at least read-write permission. Fortinet scores the attack vector as local; NVD scores it as network. Every read-write admin, admin-facing interface and stored copy of your configuration widens the exposure.

How the FortiOS CLI path traversal works

Fortinet describes a path traversal (CWE-22) in the command line interpreter: crafted arguments to existing commands let a privileged user write or delete arbitrary files. It does not name the command, and it lists the impact as privilege escalation.

Unit 42 supplied the detail. The flaw sits in the CLI's auto-script feature, which runs administrator-defined CLI scripts. FortiOS does not sanitize the script's object name, so a name containing ../ sequences places the script body anywhere on the file system, where it runs with the auto-script engine's privileges. Unit 42 describes the result as reading and writing arbitrary files as root, slightly broader than Fortinet's wording.

The restricted admin CLI is meant to be a boundary. A file write as root crosses it.

Is it being exploited?

Yes, and Fortinet said so from the start:

• Fortinet. The advisory has carried "Known Exploited: Yes" since publication, as an archived copy from 15 April shows. Fortinet has published no indicators or victim details.
• Unit 42. On 14 October 2026 it described an intrusion at a telecom managed service provider by a cluster it tracks as CL-STA-0954 (aka UNC5820). The attackers entered through a FortiManager flaw, CVE-2024-47575, in September 2024 and took the configurations of more than 500 managed firewalls, including passwords Unit 42 showed were recoverable. They later used CVE-2025-61624 to gain root on selected firewalls, deploy PEERSTITCH and plant a reverse shell through Apache's ACME module.
• CISA. KEV lists the bug from 16 October, due 19 October. CISA records active exploitation that is not automatable but has total technical impact, and its CVE record enrichment cites the Unit 42 report.

Unit 42 does not say when the CVE-2025-61624 step happened, so whether it predates Fortinet's April fix is not public. Nor has CISA explained why the listing came six months after Fortinet flagged exploitation.

Check your exposure

Confirm the version, look for auto-script objects you did not create, and see where admin access is offered:

get system status
show system auto-script
show system interface | grep allowaccess
diagnose debug crashlog read

Then search logs kept off the device, since the attackers killed local logging first:

# Auto-script objects created with traversal sequences in their names
grep -rF 'auto-script' /path/to/fortigate-logs/ | grep -F '../'
 
# Infrastructure Unit 42 tied to the intrusion
grep -rE '23\.240\.77\.233|47\.18\.167\.159|45\.32\.41\.202|198\.199\.122\.22' /path/to/fortigate-logs/

Fix it

Upgrade to the fixed release in the table, following Fortinet's upgrade path tool. On branches with no fix, plan a migration rather than waiting for a patch.

Fortinet lists no configuration workaround. Its only interim measure is a FortiGuard virtual patch, FG-VD-59270.0day, in FMWP database update 25.120, and the advisory does not say what it inspects. Until you upgrade, keep read-write admins few and offer admin access only on management networks.

Upgrading does not undo a compromise. PEERSTITCH runs in process memory, so collect volatile evidence with Fortinet support before rebooting a suspect device, then rotate admin and SSL VPN passwords and certificates held in the configuration.

Detect attempts and compromise

Unit 42 published these signals, plus file hashes and a YARA rule:

• Auto-script names. Objects named ../../../../setup or ../../tmp/apache2/conf/md-acme.conf, or any configuration revision with ../ in a system.auto-script object. The attackers deleted them after use, so check revision history.
• Staged files. index.js, index.wasm, ipssem.js and lldprx under /data2/template/, plus a self-deleting pM.js.
• Process memory. Anonymous 16 KB read-write-execute regions in /bin/miglogd or /bin/iked.
• Crashes and log gaps. Segmentation faults for miglogd, iked or syslogd, cleared crash logs, killed logging daemons and drops on the tunnel management interface.
• Infrastructure. 23.240.77[.]233 and 47.18.167[.]159, which hosted the installer, and 45.32.41[.]202 and 198.199.122[.]22, used to register a rogue FortiGate with FortiManager.

If any of these fired, treat the device as compromised, and treat every firewall managed from the same platform as exposed.

Beyond this patch

A bug that requires admin rights is only as contained as the admin credentials. Configuration backups, management platforms and reversible password storage put those credentials one breach away, so guard them like the firewall itself. Keep logs off the device too, since root can silence local logging; Rokkhe's SOC pipeline shows how forwarded events become cases with the evidence kept.