There is a gap between a CVSS score and a threat actor's willingness to use a bug, and CVE-2025-61624 is a clean example. NVD records the vulnerability at 6.0 under CVSS v3.1, medium severity. CISA added it to the Known Exploited Vulnerabilities catalogue on 16 October 2026 with a remediation deadline of 19 October. Palo Alto Networks attributes its use to a cluster tracked as UNC5820 and CL-STA-0954, which deployed ARM64 malware named PeerStitch against telecommunications targets.
The score does not make the exploitation wrong. It makes the scoring model incomplete for this case, and that distinction matters for anyone whose vulnerability management workflow filters on severity.

What the vulnerability is

CVE-2025-61624 is a path traversal, CWE-22, in FortiOS and in related products that share the code: FortiPAM, FortiProxy and FortiSwitchManager. The affected FortiOS ranges are 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, and all versions of 7.2, 7.0 and 6.4.
The path that matters runs through the command-line system.auto-script feature. A FortiOS administrator with restricted privileges can write commands that are executed outside the intended directory. The traversal takes the write to the underlying operating system, and the result is a privilege elevation from the restricted FortiOS administrator level to root on the host.
That framing explains the low score. The CVSS vector for the NVD entry reflects a requirement for authenticated access at some privilege level. What the score does not capture is what that access is worth on an edge firewall, and how common it is for an organisation to have accounts with that level of access that are reachable from somewhere unexpected.

Why a firewall is a worse target than the score suggests

An edge firewall terminates or forwards the organisation's traffic. Root on that device means the ability to read traffic that was supposed to be inspected, alter policy, and modify the logs that would otherwise record the change. PeerStitch, as described in reporting on the campaign, stays resident in FortiOS memory and bridges communications in a way designed to evade the device's own inspection.
That combination is what makes a medium-severity traversal worth a KEV entry. The attacker's position after exploitation is not proportional to the score of the entry point.

The versions worth checking first

Any FortiOS 6.4 or 7.0 deployment is affected without a version qualifier, which usually means an appliance that has been running the same firmware since installation. FortiProxy 7.2 and 7.0 are similarly affected across all versions, as are FortiPAM 1.0 through 1.6 except 1.7.0.
FortiSwitchManager appears in the affected product list as well. That product is often managed by a different team than the firewalls, and it is a reasonable guess that its patch status has not been compared against the firewall's.

Investigation, given the position

The device itself is not a trustworthy source of evidence after a root compromise. Logs on the appliance may have been altered, and an attacker with root can remove what they added.
Two approaches remain useful.
The first is out-of-band evidence. Network flow records, syslog forwarded to a collector the firewall does not control, and authentication logs from the directory used to administer the device all sit outside the compromised boundary and deserve review for authentication events around the dates in the campaign reporting.
The second is configuration diffing against a known-good baseline. Auto-script entries, administrative accounts, trusted hosts and local users that do not match the last approved configuration are worth explaining one by one. The traversal writes outside the intended directory, so unexpected files on the underlying system are also relevant, though distinguishing attacker content from vendor content on a Fortinet appliance requires vendor guidance rather than guesswork.

Patch order and the reason for it

Devices reachable for management from the internet come first. Appliances that terminate remote-access VPNs come next, because their position makes them the entry point for everything behind them. Internal segmentation firewalls last, which is the order most organisations already use and the order that most often inverts itself when the patch team is different from the network team.
After patching, restrict administrative access to management networks. The vulnerability requires an administrative session, so eliminating paths by which a restricted administrator account can be reached from an unexpected network removes the precondition rather than just the payload.

Why the severity score missed

A CVSS base score describes the properties of a vulnerability in the abstract. It does not know that the affected system sits at a trust boundary, holds the organisation's traffic, and is administered by accounts whose credentials are shared across a team. Severity scores are a triage input. The KEV catalogue is a different input: evidence that someone is actually using it.
When the two disagree, as they do here by a wide margin, the KEV entry is the one that should move the ticket.

References

  • NVD entry for CVE-2025-61624, CWE-22, CVSS v3.1 6.0

  • Fortinet advisory FG-IR-26-122 and PSIRT product coverage

  • CISA Known Exploited Vulnerabilities catalogue entry, 16 October 2026

  • Palo Alto Networks Unit 42 reporting on UNC5820, CL-STA-0954 and PeerStitch

  • iThome coverage of the CISA addition, 19 October 2026