Fortinet FortiOS CVE-2025-61624 Used to Plant the PEERSTITCH Implant on FortiGate Firewalls, Now in CISA KEV

CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-16, with a due date of 2026-10-19 for US federal agencies. Fortinet published the flaw on 14 April 2026 as FG-IR-26-122. It is a path traversal bug in the command line interface of FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. On its own it is a Medium-severity, authenticated issue: an attacker needs an admin account with read-write permissions before they can use it. Palo Alto Networks Unit 42 has now shown what that looks like in a real intrusion. (Palo Alto Networks is a Fortinet competitor; the intrusion details below are Unit 42's findings, not Fortinet's.) Attackers who had already stolen FortiGate admin credentials used the flaw to go from admin to root and install PEERSTITCH, a stealthy implant that runs only in memory. The intrusion was against a telecommunications managed service provider. It began with a compromise of that provider's central FortiManager.

Technical Information

• Vulnerability: CWE-22 path traversal in the CLI. A privileged attacker can write or delete arbitrary files by passing crafted arguments to existing commands. Fortinet classes the impact as "Escalation of privilege".
• Severity: Fortinet rates it Medium, CVSS 3.1 6.0. NVD rates it 6.5 Medium. The 5.4 figure seen in some coverage is Fortinet's temporal score. Fortinet's advisory now marks the flaw "Known Exploited: Yes".
• How the attack unfolded (Unit 42, cluster CL-STA-0954, also tracked as UNC5820):
  1. Initial access: attackers exploited the 2024 FortiManager flaw known as FortiJump (see Rescana's earlier FortiManager advisory) on the provider's FortiManager.
  2. Data theft: they took configurations, database files and cryptographic material for more than 500 managed FortiGate firewalls, covering the provider's own infrastructure and its clients' networks.
  3. Credential recovery and login: they recovered admin and SSL-VPN passwords from that data and used them to log in.
  4. Privilege escalation: they used CVE-2025-61624 to go from FortiOS admin to root on selected firewalls.
  5. Implant: on those firewalls they deployed PEERSTITCH, an ARM64 implant that hooks the logging (miglogd) and IKE/VPN (iked) daemons. Unit 42 says it "leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections."
• Scope, stated carefully: configuration data for more than 500 firewalls was stolen. The implant went to "a select number of firewalls". Unit 42 did not examine the client networks, and describes the exposure there as "of configuration and credential material rather than confirmed intrusion". It says the post-exploitation activity overlaps with intrusions attributed to suspected nation-state actors. It names no country.
• Timing: Unit 42 says the intrusion "occurred in September 2024" and was prolonged. It does not give a separate date for when CVE-2025-61624 was used.
• KEV entry: "Fortinet Multiple Products Path Traversal Vulnerability", dateAdded 2026-10-16, dueDate 2026-10-19, forensicTriage Yes, known ransomware campaign use Unknown.

Affected Product Versions

Workaround and Mitigation

1. Upgrade to a fixed release from FG-IR-26-122, using Fortinet's upgrade-path tool. As a stopgap, Fortinet offers a virtual patch, "FG-VD-59270.0day", in FMWP database update 25.120.
2. Close the original entry point. If you use FortiManager, make sure it is patched for the 2024 FortiJump flaw.
3. Assume stolen management data is still valid. Unit 42 advises treating the credentials and certificates a management platform holds as compromised once the platform is, and notes that patching the platform does not end that compromise. Rescana recommends (this is Rescana's guidance, not Fortinet's or Unit 42's) rotating FortiGate admin and SSL-VPN passwords and the FortiManager trust material.
4. Hunt:
   • Unit 42 guidance: check FortiOS configuration revisions for system.auto-script objects whose names contain path-traversal sequences.
   • Unit 42 guidance: look in crash logs for segmentation faults involving miglogd, iked or syslogd.
   • Rescana inference from the behavior Unit 42 describes (not Unit 42 guidance): watch for unexpected admin accounts, SSL-VPN sessions from unknown sources, and packet-capture (sniffer) rules you did not create.

Indicators of Compromise

Published by Unit 42. Validate these before you block on them.

Unit 42 also publishes a YARA rule. No MITRE ATT&CK mapping is published.

Sources

• Fortinet PSIRT advisory FG-IR-26-122
• Unit 42: PEERSTITCH research
• The Hacker News coverage
• NVD entry for CVE-2025-61624

What This Means for Your Third-Party Risk Program

This is a management-chain story. A "Medium" bug became serious because one compromised management platform at a service provider exposed credentials for hundreds of firewalls that protect other organizations. A fast but accurate review focuses on which suppliers and MSPs manage FortiGate devices on your behalf, or sit in front of your data, not on everyone who owns a Fortinet product. Ask them:

1. Are your FortiOS, FortiProxy, FortiPAM and FortiSwitchManager versions at or above the FG-IR-26-122 fixes?
2. Do you manage devices that protect our environment through FortiManager, and is it patched for the 2024 FortiJump flaw?
3. Have you checked for auto-script objects with path-traversal names, and rotated admin passwords, SSL-VPN passwords and FortiManager trust material?
4. Who can reach your firewall admin and management interfaces from the internet?

Forward this to your TPRM owner: Fortinet CVE-2025-61624 (Medium, authenticated) is in CISA KEV, due 19 October. It was used to plant the PEERSTITCH implant after attackers stole MSP-managed firewall configurations. Please check which MSPs manage our FortiGate or FortiManager estate and send them the four questions above.
If you'd like help working out which of your vendors and MSPs manage FortiGate firewalls through FortiManager, book a demo.