CVE-2025-61624: a Fortinet bug is on the US 'actively exploited' list — but the details are thin

A vulnerability tracked as CVE-2025-61624, affecting unspecified Fortinet products, has been added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalogue. The listing, dated 16 October, means CISA has confirmed real-world exploitation rather than a theoretical risk flagged by a researcher. That’s the headline fact. What’s missing from the public record so far is almost everything else.

What’s actually confirmed

CISA’s KEV catalogue exists specifically to flag flaws that are being actively abused, not merely possible to abuse. By listing CVE-2025-61624, the agency is stating that it has evidence of exploitation in the wild. Federal civilian agencies in the US have been given until 19 October to apply fixes or mitigations, under a binding operational directive that compels government bodies — but nobody else — to act within a set window.

Beyond that, the entry itself is sparse. Fortinet is named as the vendor, but the affected product is listed only as “Multiple Products” rather than a specific firewall, VPN appliance or management platform. Whether this is a known ransomware vector is marked “unknown” in CISA’s own data. There’s no CVSS severity score attached in what’s been published, no description of whether the bug allows remote code execution, authentication bypass, or something else entirely, and no confirmation of which software versions are vulnerable or since when.

So who is actually at risk

This is not a consumer issue. Fortinet’s product line — firewalls, VPN gateways, network security appliances — sits almost entirely in business and government infrastructure, not in home routers or laptops. If you don’t administer enterprise network hardware, this bug has no direct bearing on you.

For organisations running Fortinet kit, the calculus is different. A KEV listing is a strong signal that attackers have already worked out how to exploit the flaw, and that waiting for a “quiet patch Tuesday” approach is riskier than usual. The federal deadline doesn’t legally apply to private companies or outside the US, but security teams generally treat KEV entries as a de facto priority list regardless of jurisdiction, because the exploitation has already been proven rather than merely predicted.

What to do about it

If you or your organisation run Fortinet appliances, the sensible move is to check Fortinet’s own advisories directly for CVE-2025-61624, identify whether your specific product and firmware version is listed as affected, and apply whatever patch or mitigation the vendor has published. CISA’s guidance points towards its general risk-based patching framework (BOD 26-04) and forensic triage advice for anyone who suspects they may already have been compromised — a reasonable precaution given that exploitation is confirmed rather than hypothetical.

For everyone else, there isn’t a practical action here. This is enterprise security plumbing, not something that touches a personal phone, laptop or home network.

The takeaway

The confirmed part of this story is narrow but real: a Fortinet vulnerability is being exploited right now, and CISA has flagged it accordingly. The unconfirmed part — what the bug does, how widely it’s being used, and exactly which products are exposed — hasn’t yet been made public in enough detail to say more. Network administrators running Fortinet hardware should go straight to the vendor’s advisory rather than relying on this entry alone; everyone else can file it under “not your problem” and move on.