Palo Alto Networks reports that a threat actor exploited multiple Fortinet vulnerabilities in an attack against a telecommunications organization. The intrusion occurred in September 2024 and resulted in long-term access to the victim's environment.
What happened
The management layer was the target, not a single firewall. A fresh report from Palo Alto Networks shows that the same intrusion also involved CVE-2025-61624CVSS 6.5 MEDIUM / Published 2026-04-14An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.View on NVD, a path traversal vulnerability affecting multiple Fortinet products.
For anyone running Fortinet management infrastructure, the public listing of that flaw is the practical signal to act.
On Friday, the US cybersecurity agency CISA added CVE-2025-61624CVSS 6.5 MEDIUM / Published 2026-04-14An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.View on NVD to its Known Exploited Vulnerabilities (KEV) list, urging federal agencies to patch it immediately.
How it was done
As part of the observed attack, FortiJump was exploited to access a central FortiManager instance. A rogue Virtual FortiGate appliance was then registered against that instance.
From there a configuration archive was exfiltrated, containing details on FortiManager, more than 500 managed FortiGate firewalls, and the victim's network. A configuration archive of that kind is a map of the estate, which is why access to a management server matters more than access to any one device.
What to check
If you run Fortinet management infrastructure, work through these in order.
Patch CVE-2025-61624CVSS 6.5 MEDIUM / Published 2026-04-14An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.View on NVD across every affected product
Build an inventory of Fortinet products in scope, then compare installed firmware against the fixed versions in the vendor advisory. Treat the CISA Known Exploited Vulnerabilities entry as the deadline. Any device still on a pre-fix build after your patch window is a finding.
Review every device registered to FortiManager
Open Device Manager and list all managed devices, including virtual ones, with their serial numbers and registration dates. Reconcile that list against your asset inventory. A device you cannot map to a purchase order or a deployment ticket should be quarantined and investigated.
Pull registration and authentication logs for the management server
In FortiManager, export the event log for device registration, admin login and ADOM changes, then search for unattended registrations and logins from unexpected source addresses. Correlate against VPN and jump host records. Unmatched source IPs or out of hours activity are the markers to chase.
Confirm the management plane is not reachable from the internet
Scan your public ranges for the FortiManager management ports, for example with nmap from an external host, and check cloud security group and edge firewall rules. Any response from outside your administrative network means the exposure needs closing before anything else.
Treat stored configuration data as compromised credentials
Configuration backups usually carry shared secrets, VPN pre-shared keys, SNMP strings and local admin hashes. Identify every copy, including off box archives and ticket attachments, and rotate the secrets they contain. Leaving old keys valid is the common gap after this kind of event.
Look for outbound transfers from management hosts
Query netflow or proxy logs for large egress from your FortiManager host over the retention period you hold. Sort by bytes sent and destination. Sustained transfers to destinations outside your backup and vendor ranges warrant a full forensic review of the host.