New Fortinet Vulnerability: What SMBs Need to Know

What is CVE-2025-61624 and Why Should SMBs Care?

CVE-2025-61624 is a path traversal vulnerability found in multiple Fortinet products. This means an attacker could potentially access files or directories on a system that should be off-limits. This flaw could allow an attacker to bypass security controls and access sensitive data or system configurations.

SMBs that use Fortinet products—like firewalls, routers, or security gateways—are at risk. If not patched, attackers could exploit this vulnerability to gain unauthorized access to your network, potentially leading to data breaches or system compromise.

This vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) list on October 16, 2026, meaning it’s already being used in real-world attacks. This is not a theoretical risk—it’s happening now.

How Does This Vulnerability Affect SMBs?

SMBs often rely on Fortinet products for network security and firewall protection. If your organization uses any of the affected Fortinet products, you could be vulnerable to exploitation. Attackers could potentially access sensitive files, steal credentials, or even take control of your network infrastructure.

The impact depends on how your Fortinet devices are configured and what data they protect. In the worst case, an attacker could use this vulnerability to move laterally across your network, access customer data, or deploy malicious activities.

It’s important to know exactly which Fortinet products you use and whether they’re affected. If you’re unsure, take the time to identify and inventory your Fortinet devices.

What Should SMBs Do This Week?

First, identify which Fortinet products you have in your environment. This includes firewalls, routers, and other network devices. Check if they are listed as affected in the CVE-2025-61624 advisory.

Next, apply the vendor’s security patch immediately. Fortinet has released updates to address this vulnerability. If you’re unsure how to apply the patch, consult with your IT team or a cybersecurity expert.

If you don’t have the resources to manage this internally, consider reaching out to a cybersecurity service provider to help with patching and vulnerability management.

Finally, monitor your network for any unusual activity. Attackers may be actively scanning for vulnerable systems. Use logs and intrusion detection tools to detect potential exploitation attempts.

How Can You Tell if You’ve Already Been Hit?

If you suspect your Fortinet devices may have been exploited, look for signs of unauthorized access. This includes unexpected login attempts, unusual traffic patterns, or unexpected changes to system configurations.

Check your logs for any access attempts to restricted files or directories. Look for any unusual or suspicious activity.

If you’re unsure whether your systems have been compromised, consider hiring a cybersecurity expert to perform a forensic analysis of your network. They can help determine if the vulnerability was exploited and what data may have been accessed.

Why Is This Vulnerability a Big Deal?

This vulnerability is particularly dangerous because it allows attackers to bypass security controls and access sensitive data. In the wrong hands, this could lead to data breaches, financial loss, or reputational damage.

The fact that it’s already being exploited in the wild means attackers are actively targeting vulnerable systems. Delaying a patch could leave your business exposed to real attacks.

SMBs often lack the resources to detect and respond to sophisticated attacks. That’s why it’s crucial to act quickly and ensure your Fortinet devices are secure.

What if I Can’t Patch Right Away?

If you can’t apply the patch immediately, consider implementing workarounds to reduce risk. For example, you can restrict access to Fortinet devices using firewall rules or network segmentation.

Limit access to only trusted users and disable unnecessary services or ports that could be exploited.

Monitor your Fortinet devices closely for any suspicious activity. Set up alerts for unusual login attempts or file access attempts.

If you’re unsure how to implement these workarounds, reach out to a cybersecurity expert for guidance.

Not sure whether your environment is exposed? That is exactly what our Vulnerability Management service is built to surface. Talk to us.

Frequently asked questions

Source (public domain): CISA