CISA confirms active exploitation of CVE-2025-61624 in Fortinet products
CVE-2025-61624 affects multiple Fortinet products and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog, with a date of October 16, 2026 in the sources. The listing confirms active exploitation. Fortinet has already released a fix; apply the update and follow the patched versions in advisory FG-IR-26-122.
What happened
CISA added CVE-2025-61624, which affects multiple Fortinet products, to its Known Exploited Vulnerabilities (KEV) catalog. This confirms attackers are already exploiting the flaw. Fortinet has released a fix.
Why it matters
Fortinet products protect corporate networks. A flaw under exploitation in this equipment can open the door to intrusions, data access, and operational downtime. The Fortinet advisory rates severity as high.
What to do
Apply the Fortinet updates immediately, following the patched versions in advisory FG-IR-26-122. Identify which Fortinet products in the company are in scope and prioritize the most critical ones.
For the technical team
- CVE
- CVE-2025-61624
- Affected
- Múltiplos produtos Fortinet (escopo exato das versões no aviso do fornecedor) · Multiple Fortinet products; exact version scope in the vendor advisory. Affected versions not listed in the CISA feed.
- Exploitation
- Active exploitation confirmed by inclusion in the CISA KEV catalog; start date recorded as October 16, 2026 in the source.
- Fix
- Fix available; patched versions detailed in the Fortinet advisory (FG-IR-26-122).
- More details
- Fortinet advisory: FG-IR-26-122, at fortiguard.fortinet.com. CVE recorded in NVD. Reference severity: high in the Fortinet advisory.
Timeline
Initial dossier: Fortinet advisory, NVD entry, and CISA KEV inclusion confirm active exploitation.
