FortiOS CVE-2025-61624 Exploited to Plant PEERSTITCH Implant

FortiOS CVE-2025-61624, a path traversal flaw in the FortiOS command line interpreter that Fortinet fixed in April 2026, was added to the CISA Known Exploited Vulnerabilities catalog on October 16, 2026, with a federal deadline of October 19. Palo Alto Networks Unit 42 tied it to PEERSTITCH, a memory-only implant planted on FortiGate firewalls at a telecom managed service provider. If you run FortiOS, FortiProxy, FortiPAM or FortiSwitchManager, confirm you are on a fixed release and audit admin accounts and auto-scripts now.

What happened

On October 14, 2026, Unit 42 researchers Daniel Gott and Shawn Westfall published an account of a long intrusion at a telecommunications managed service provider. They track the actor as CL-STA-0954, also tracked as UNC5820. Unit 42 says parts of the post-exploitation activity overlap with intrusions attributed to suspected nation-state actors, but it does not name a country.

The attackers got in through CVE-2024-47575, the FortiManager missing-authentication flaw known as FortiJump (CVSS 9.8, in the KEV catalog since October 23, 2024). From the central FortiManager they registered a rogue virtual FortiGate and pulled an archive covering more than 500 managed FortiGate firewalls. That archive held running configurations, network topology, a serial number and public IP inventory, encrypted administrator and SSL VPN credentials, and certificates with their private keys. Unit 42 says the encrypted credentials could be recovered by brute force.

With those credentials, the actor logged in to downstream firewalls over SSL VPN, pushed packet-capture rules aimed at unencrypted HTTP, TFTP, RADIUS and LDAP traffic, and then used CVE-2025-61624 to move from an administrator session to root-level file access. That root access is what let them load PEERSTITCH.

CISA added CVE-2025-61624 to KEV two days after the Unit 42 report. The entry marks forensic triage as required and lists known ransomware use as unknown.

What FortiOS CVE-2025-61624 does

Fortinet advisory FG-IR-26-122, published April 14, 2026, describes a CWE-22 path traversal in the CLI. A privileged user can pass crafted arguments to existing commands and write or delete arbitrary files. Unit 42 places the bug in the FortiOS CLI auto-script engine. Fortinet rates it Medium with a CVSS v3 base score of 6.0 (temporal 5.4); the CVE record carries the 5.4 vector. Some outlets quote other figures, so use the vendor score when you document the risk. Fortinet found the bug internally, and its advisory now lists it as known exploited.

The low score reflects the precondition: the attacker needs an admin profile with at least read-write permission. In this campaign that precondition was already met, because the actor held stolen administrator credentials for hundreds of firewalls. For the triage logic behind admin-only bugs, see our note on what CVSS Privileges Required means for patch triage.

Who is affected

The CVE record and Fortinet advisory list these affected releases and fixes:

FortiOS 7.6.0 through 7.6.4: upgrade to 7.6.5 or later
FortiOS 7.4.0 through 7.4.9: upgrade to 7.4.10 or later
FortiOS 7.2, 7.0 and 6.4 (all versions): migrate to a fixed release
FortiProxy 7.6.0 through 7.6.4: upgrade to 7.6.5 or later; 7.4.0 through 7.4.11: upgrade to 7.4.12 or later; 7.2 and 7.0: migrate
FortiSwitchManager 7.2.0 through 7.2.7: upgrade to 7.2.8; 7.0.0 through 7.0.6: upgrade to 7.0.7
FortiPAM 1.7.0: upgrade to 1.7.1; 1.0 through 1.6: migrate; 1.8 is not affected

If you still run FortiOS 7.2 or older, there is no patch on your branch. You have to move to 7.4.10 or 7.6.5. Fortinet also lists a virtual patch, FG-VD-59270.0day, in FMWP database update 25.120.

The highest-risk group is any organization whose FortiGates are managed by a FortiManager that was exposed to CVE-2024-47575, including customers of MSPs that manage firewalls on their behalf.

How PEERSTITCH hides

PEERSTITCH is a 64-bit ARM Linux binary written in C. Unit 42 describes it as a one-shot injector: it writes code into two FortiOS daemons, miglogd (logging) and iked (IKE and IPsec VPN), then deletes itself. Nothing stays on disk, it opens no listening port and it makes no outbound connections of its own. The two hooked daemons pass messages to each other in memory, and a VPN session carrying a specific marker is routed down a path that skips default FortiOS security checks. Our explainer on what memory-resident malware on a network appliance is covers why this design defeats file-based scanning.

The actor also abused the Apache mod_md certificate module on the FortiGate for a reverse shell that re-established itself, and impersonated FortiManager under a "FortiGateCloud" account to pull configurations from other firewalls. Unit 42 assesses that step with medium confidence.

Cleanup was thorough. The actor stopped logging and syslog daemons before running auto-scripts, cleared segmentation-fault crash logs, deleted rogue admin accounts, VPN groups and auto-script objects after use, and caused intermittent drops on the management tunnel to starve central consoles of telemetry. Missing logs were part of the attack, which is why detecting firewall logging gaps matters as much as reading the logs you have.

What to do now

Upgrade every FortiOS, FortiProxy, FortiPAM and FortiSwitchManager device to a fixed release from the list above. Use Fortinet's upgrade path tool for multi-step upgrades.
Confirm FortiManager is patched for CVE-2024-47575 and that TCP 541 and the management interface are not reachable from the internet. Our guide on restricting firewall management access to a jump box covers the network side.
Review configuration revision history for auto-script objects, especially any whose arguments contain path traversal sequences, and for admin accounts or VPN groups that were created and then deleted.
Pull crash logs and look for segmentation faults in miglogd, iked or syslogd. Unit 42 lists these as artifacts of failed injection attempts.
Compare log volume from each firewall against its normal baseline and investigate silent periods.
If FortiManager was exposed to FortiJump, treat every credential, certificate and private key it held as stolen. Unit 42 warns that exfiltrated trust material stays valid until it is rotated. The reasoning is laid out in why a firewall manager compromise exposes every device.

Unit 42's memory checks (anonymous 16 KB read-write-execute regions in /proc/<pid>/maps for the two daemons, overwritten text segments, and cross-process memory writes in kernel telemetry) need root shell access that most FortiGate owners do not have. If you suspect compromise, open a case with Fortinet support or an incident response firm rather than improvising on a production firewall. A clean result from built-in checks does not prove the device is clean, as we covered in why a clean integrity check cannot clear a compromised appliance.

What to watch next

Watch for Fortinet to publish its own indicators or an integrity-check update that detects PEERSTITCH's daemon patches. Also watch for confirmation of whether CVE-2024-26009 and CVE-2024-26008, which Unit 42 suspects but has not confirmed, played a part. Finally, watch for disclosure from the MSP's clients: the stolen archive covered client networks, not only the provider's own.

This is the second exploited FortiOS bug we have covered in five weeks, after the FortiOS cw_acd flaw CVE-2025-25249 used to drop PivotC2.