Loading vulnerability…
Cleartext Credential Exposure in Memory via FortiPAM CLI Diagnose Commands
CVE-2025-61713 is a cleartext storage of sensitive information in memory vulnerability in Fortinet FortiPAM. According to the provided content, affected versions are FortiPAM 1.6.0, 1.5 all versions, 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, and 1.0 all versions. Sensitive information, specifically other administrators' credentials, may be retained in memory in cleartext and exposed through CLI diagnose commands. An authenticated attacker with read-write administrator privileges to the CLI can retrieve these credentials from memory.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker with sufficient CLI administrative privileges to obtain other administrators' credentials. This can enable compromise of additional privileged accounts, unauthorized access to FortiPAM administrative functions, privilege abuse across shared administration boundaries, and potential follow-on actions depending on how the recovered credentials are reused within the environment.
If you can’t patch tonight, do this now.
Until patching is completed, restrict CLI access to the smallest possible set of trusted administrators, limit or disable use of diagnose commands where operationally feasible, and closely monitor administrative CLI activity for credential-access attempts. Enforce least privilege for FortiPAM administrators, rotate potentially exposed administrator credentials, and review whether recovered credentials may have been reused elsewhere. Network segmentation and robust privilege restriction, as recommended in the advisory context, can further reduce exposure.
Patch, then assume compromise.
Apply Fortinet vendor patches or upgrade to a fixed FortiPAM release as provided by Fortinet. The provided content confirms that Fortinet has released patches and recommends immediate updates to affected systems. Organizations should prioritize upgrading all affected FortiPAM versions, including 1.6.0 and all versions in the 1.0 through 1.5 branches, to a non-vulnerable release identified by Fortinet.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.