FortiOS CVE-2025-61624 scores 6.0 but is exploited to root firewalls

Path traversal CVE-2025-61624 in FortiOS and related Fortinet products carries a CVSS score of 6.0, yet CISA added it to its Known Exploited Vulnerabilities catalogue on 16 October 2026. The UNC5820 (CL-STA-0954) cluster used it to elevate a restricted admin to root on edge firewalls and deploy ARM64 malware PeerStitch against telecom targets.

• CVE-2025-61624 is a path traversal (CWE-22) rated CVSS 6.0
• Affected: FortiOS 7.6.0–7.6.4, 7.4.0–7.4.9 and all 7.2, 7.0, 6.4 versions
• CISA added it to KEV on 16 October 2026 with a 19 October deadline
• UNC5820 deployed ARM64 malware PeerStitch against telecom targets