Our automated tracking framework flagged that CISA added CVE-2025-61624 (Fortinet Multiple Products) to the Known Exploited Vulnerabilities (KEV) catalog on October 19, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2025-61624 by October 19, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2025-61624 |
| Vendor / product | Fortinet Multiple Products |
| Vulnerability | Fortinet Multiple Products Path Traversal Vulnerability |
| CVSS base score | 6 |
| Added to KEV | October 16, 2026 |
| Days public before listing (NVD → KEV lag) | 185 |
| Federal patch deadline | October 19, 2026 |
| Known ransomware use | No |
How This Compares to Fortinet’s Track Record
This one was public for 185 days before CISA confirmed exploitation — longer than Fortinet’s 10-day median, a vulnerability that sat exploitable in the open.
| Fortinet in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 32 |
| Median lag (public → KEV listing) | 10 days |
| 0-day rate (exploited at or before disclosure) | 34% |
| Entries tied to known ransomware campaigns | 13 |
For perspective, the median across all 1748 tracked KEV entries is 239 days — Fortinet’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Fortinet KEV Additions
The most recent Fortinet vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-104286 | FortiMail | October 1, 2026 | 0 | No |
| CVE-2025-25249 | Multiple Products | September 9, 2026 | 239 | No |
| CVE-2025-68686 | FortiOS | July 27, 2026 | 167 | No |
| CVE-2026-25089 | FortiSandbox | July 16, 2026 | 37 | No |
| CVE-2026-39808 | FortiSandbox | July 16, 2026 | 93 | No |
What This Means for Defenders
CISA has added CVE-2025-61624, a path traversal vulnerability affecting Fortinet Multiple Products, to its Known Exploited Vulnerabilities (KEV) catalog. It’s a critical need for attention and patching. With a CVSS base score of 6, the KEV listing confirms active exploitation. All organizations using Fortinet products are exposed, with federal agencies facing a strict deadline of October 19, 2026, to apply patches. All organizations should prioritize patching before the federal deadline.
The vulnerability was public for 185 days before its KEV listing on October 16, 2026, suggesting a prolonged period of potential exploitation. While no ransomware use is currently known, active exploitation of path traversal vulnerabilities often leads to deeper system compromise, making immediate patching paramount to close this window.
If you can’t patch before October 19, 2026, restrict access to affected systems. Enhance network segmentation, deploy threat detection rules to monitor for path traversal attempts and anomalous activity, and ensure security logs are actively reviewed for signs of compromise. A plan for rapid patch deployment should remain the highest priority.
Related Coverage
- Fortinet’s CVE-2026-104286 Was Exploited Before It Was Public — Its Median Lag Is 7 Days (October 2026)
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
