Fortinet CVE-2025-61624 Added to CISA KEV Under Active Exploitation
A critical Fortinet vulnerability, CVE-2025-61624, has been confirmed as actively exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog on October 16, 2026.
Key findings
- Fortinet's CVE-2025-61624 was added to CISA KEV on October 16, 2026.
- The vulnerability is confirmed to be under active exploitation in the wild.
- Immediate patching and mitigation are critical for all affected organizations.
- CISA's KEV listing mandates urgent remediation for federal agencies.
CISA has issued an alert regarding a Fortinet vulnerability, CVE-2025-61624, which has been observed under active exploitation. The flaw's inclusion in the Known Exploited Vulnerabilities (KEV) catalog on October 16, 2026, signals its immediate threat to federal agencies and critical infrastructure organizations. This designation underscores the urgency for all organizations to address the vulnerability promptly, as it represents a proven pathway for adversaries to compromise systems.
The vulnerability, identified as CVE-2025-61624, affects Fortinet products, though specific product details were not immediately released with the KEV addition. Its active exploitation means that threat actors have successfully developed and deployed exploits against this flaw, posing a direct and ongoing risk. While details about the nature of the vulnerability (e.g., remote code execution, privilege escalation) are typically released by the vendor, its presence in the KEV catalog confirms its severity and the need for immediate action.
Organizations utilizing Fortinet products are strongly advised to consult official vendor advisories for CVE-2025-61624 and apply all available patches or mitigation strategies without delay. CISA's KEV catalog mandates that federal civilian executive branch (FCEB) agencies remediate this vulnerability by a specific due date, typically within a few weeks of its listing. However, all organizations, regardless of sector, should prioritize patching this actively exploited flaw to protect their networks from potential compromise. Proactive patching is the most effective defense against threats leveraging known exploited vulnerabilities.