Infrastructure
CVE-2025-61625
Authenticated path traversal allows file write/delete on FortiAnalyzer/FortiManager
Major vulnerability. Affects widely deployed Fortinet enterprise management appliances (FortiAnalyzer/FortiManager). Authenticated low-privilege file write/delete can disrupt security infrastructure and operations across many organizations.
- CVSS
- 8.1High
- Exploited in the wild
- Not knownnot in CISA KEV as of our last sync
- EPSS
- No score yet
- Fix
- Not stated by the vendorno fixed release in the CVE record
- Published
- 10 Nov 2026analysed here 12 Nov 2026
Summary
Impact
Authenticated low-privilege user can write and delete filesystem files via crafted HTTP(S) requests, enabling tampering, persistence, or denial-of-service.
Triage
The summary, impact and action text on this page are written by our AI analysis pipeline, or taken from the NVD description when a CVE was imported from NVD. They are not the vendor's wording: check them against the sources. A longer AI executive summary and technical analysis are generated for signed-in accounts on the Max plan.
Affected products
| Product | Affected versions | Vendor says fixed in |
|---|---|---|
| Fortinet FortiAnalyzer | >= 7.6.0 and <= 7.6.4>= 7.4.0 and <= 7.4.7>= 7.2.0 and <= 7.2.11Vendor says fixed in: not stated | |
| Fortinet FortiManager | >= 7.6.0 and <= 7.6.4>= 7.4.0 and <= 7.4.7>= 7.2.0 and <= 7.2.11Vendor says fixed in: not stated | |
| Fortinet FortiManager Cloud | >= 7.6.0 and <= 7.6.4>= 7.4.1 and <= 7.4.7>= 7.2.1 and <= 7.2.10Vendor says fixed in: not stated |
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.
Products named in our analysis
- FortiAnalyzer 7.6.0-7.6.4
- FortiAnalyzer 7.4.0-7.4.7
- FortiAnalyzer 7.2.0-7.2.11
- FortiManager 7.6.0-7.6.4
- FortiManager 7.4.0-7.4.7
- FortiManager 7.2.0-7.2.11
- FortiManager Cloud 7.6.0-7.6.4
- FortiManager Cloud 7.4.1-7.4.7
- FortiManager Cloud 7.2.1-7.2.10
Fix and mitigation
Action required
Immediate action required
WAF and other mitigations
Can a WAF block it? Yes. Path traversal sends `../` sequences in the request, which WAF rules catch, including the common encodings.
Also consider: canonical path validation
Based on the weakness type only; no CVE-specific evidence yet. We check Cloudflare, AWS, Google Cloud Armor and Azure; for Akamai, Imperva, Fastly, F5, ask your vendor.
Remediation steps (AI-written)
Step-by-step remediation is generated for accounts on the Max plan, for CVEs that match a technology in their stack. Add this technology to your stack to see the fix checklist.
Exploitation evidence
- CISA KEV catalog
- Not listed as of our last sync.
- Public exploit code
- None on record in Exploit-DB, Metasploit, Nuclei templates or PoC-in-GitHub.
- CISA SSVC
- exploitation none, automatable no, technical impact totalAssessed by CISA 10 Nov 2026 (SSVC 2.0.3). Exploitation is none, poc (public proof of concept) or active.
Timeline
- 10 Nov 2026CISA SSVC assessment: exploitation none
- 10 Nov 2026Published1 day later
- 11 Nov 2026CVE record last updatedsame day later
- 12 Nov 2026Analysed by vulneraibility.com1 day later
Common questions
Is CVE-2025-61625 being exploited?
Not confirmed. CVE-2025-61625 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked.
How severe is CVE-2025-61625?
CVE-2025-61625 is rated High with a CVSS score of 8.1. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2025-61625?
Not known from our data. No patch reference has been recorded for CVE-2025-61625, which is not the same as no patch existing — a fix may have shipped without a tagged reference, or after this record was written. The vendor advisory is the only authority on whether a fix exists, and mitigations may be available regardless.
What does CVE-2025-61625 affect?
CVE-2025-61625 affects FortiAnalyzer 7.6.0-7.6.4, FortiAnalyzer 7.4.0-7.4.7, FortiAnalyzer 7.2.0-7.2.11, FortiManager 7.6.0-7.6.4, and 5 further products or versions. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2025-61625?
Apply vendor patch/mitigation when available; restrict management UI, remove/limit low-privilege accounts.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
References
1 reference in the CVE record, grouped by the tags the record gives them.
Other links (1)
- fortiguard.fortinet.com /psirt/FG-IR-26-190
Where the data on this page comes from
- CVE List (CVE.org): description, affected versions, references; CVE Terms of Use
- NVD: CVSS and CPE data
- CISA Vulnrichment (ADP): SSVC decision points
- FIRST EPSS: exploit probability and percentile
Summary, impact and triage tags: written by our AI analysis pipeline from the sources above. Check them against the sources.
Similar CVEs
Get CVEs like this by email. Join the free digest: the CVEs we flag as major, all CVSS 8.0 or higher, in up to three emails a day (sent at 05:00, 11:00 and 15:00 UTC). Matching alerts to the products you run needs an account, and accounts are invite-only during the beta.