Fortinet FortiOS: Path traversal in CLI allows arbitrary file write and delete

Summary

A path traversal flaw in the command-line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager lets an authenticated attacker with an admin profile and at least read-write permissions write or delete arbitrary files via specially crafted CLI commands. CISA lists the vulnerability as actively exploited. Per secondary reporting, attackers used it as a privilege-escalation step during a campaign. NVD scores it 6.5 (medium); Fortinet's advisory lists 6.0.

Affected

• FortiOS 7.6.0 through 7.6.4
• FortiOS 7.4.0 through 7.4.9
• FortiOS 7.2, 7.0 and 6.4: all versions
• FortiProxy 7.6.0 through 7.6.4
• FortiProxy 7.4.0 through 7.4.11
• FortiProxy 7.2 and 7.0: all versions
• FortiPAM 1.7.0
• FortiPAM 1.6, 1.5, 1.4, 1.3, 1.2, 1.1 and 1.0: all versions
• FortiSwitchManager 7.2.0 through 7.2.7
• FortiSwitchManager 7.0.0 through 7.0.6

Fixed in

• FortiOS 7.6.5 or above
• FortiOS 7.4.10 or above
• FortiOS 7.2, 7.0 and 6.4: migrate to a fixed release (fixed build not named in the advisory)
• FortiProxy 7.6.5 or above
• FortiProxy 7.4.12 or above
• FortiPAM 1.8.0 or above
• FortiPAM 1.7.1 or above
• FortiSwitchManager 7.2.8 or above
• FortiSwitchManager 7.0.7 or above
• FortiSASE: fixed in version 25.4.b, no customer action required

Workaround

• No vendor workaround is documented for the affected branches.
• Virtual patch "FG-VD-59270.0day." is available in FMWP database update 25.120. It is a mitigation and does not replace the firmware upgrade.
• Restrict administrative access (GUI, SSH and CLI) to internal or VPN-only management networks.

Exploitation

• CISA lists the vulnerability as known exploited (added 2026-10-16).
• Per secondary reporting on Unit 42's PEERSTITCH research, the flaw was used as a privilege-escalation step.
• No public proof of concept is confirmed. This does not mean that no exploit code exists.
• CISA SSVC: exploitation active, automatable no, technical impact total.

Our recommendation

• Check whether FortiOS, FortiPAM, FortiProxy or FortiSwitchManager is in use and which version is installed.
• Upgrade to the fixed versions listed above, or to a supported fixed release. Use Fortinet's upgrade path tool.
• Apply the FG-VD-59270.0day. virtual patch as an interim measure if an upgrade cannot be done immediately.
• Check whether admin interfaces are reachable from the internet and restrict them.
• Enforce MFA on all admin accounts, remove unneeded or shared admin accounts, and rotate credentials if a compromise is suspected.
• Review the configuration and logs for unexpected changes and unknown admin accounts.
• Monitor for unexpected file changes and administrative activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Fortinet PSIRT FG-IR-26-122 fortiguard.fortinet.com
• CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
• CISA alert: KEV additions, 16 October 2026 www.cisa.gov
• Siemens SSA-975644 cert-portal.siemens.com
• Unit 42: PEERSTITCH research unit42.paloaltonetworks.com
• The Hacker News: Attackers exploit FortiOS flaw thehackernews.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:21.