CISA lists Fortinet CLI flaw CVE-2025-61624 as exploited after Unit 42 ties it to PEERSTITCH implant

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on October 16 added CVE-2025-61624, a path traversal vulnerability in several Fortinet products, to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The same update also listed CVE-2026-102764, an authentication bypass in BeyondTrust Remote Support. CISA encourages all organizations to prioritize fixing flaws listed in the catalog.

Fortinet's advisory FG-IR-26-122, first published on 2026-04-14, describes a path traversal weakness (CWE-22) in the command-line interface shared by FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. According to Fortinet, an attacker who already holds privileged access could pass crafted arguments to existing commands in order to write or delete arbitrary files. The vendor rates the issue Medium with a CVSSv3 score of 6.0, classifies it as authenticated with an escalation-of-privilege impact, and flags it as known exploited. FortiOS is fixed in 7.6.5 and 7.4.10 or later, while every release of the 7.2, 7.0 and 6.4 branches has no fix and must be moved to a fixed release. Fortinet lists FortiProxy 7.6.5 and 7.4.12, FortiPAM 1.7.1 and FortiSwitchManager 7.2.8 and 7.0.7 as fixed versions, with older FortiProxy and FortiPAM branches also requiring migration. A virtual patch is available through Fortinet's FMWP database, the advisory states.

Palo Alto Networks Unit 42 tied the flaw to an intrusion at a telecommunications managed service provider that it dates to September 2024 and tracks as CL-STA-0954, also known as UNC5820. According to Unit 42, the attackers first exploited CVE-2024-47575 on a central FortiManager appliance and took an archive with running configurations, cryptographic material and databases covering more than 500 managed FortiGate firewalls that protected both the provider and its clients. The researchers said the attackers later recovered credentials from those files, opened SSL VPN sessions, and abused CVE-2025-61624 through the FortiOS auto-script feature to move from administrator access to root. That access was used to install PEERSTITCH, which Unit 42 describes as a new memory-resident ARM64 implant that writes no persistent binary to disk, opens no listening ports and makes no outbound connections, instead piggybacking on traffic of legitimate processes.

Unit 42 also reported a reverse-shell channel built by abusing the Apache mod_md module on the firewalls, and anti-forensic steps such as stopping logging daemons, clearing crash logs and deleting rogue accounts and auto-script objects shortly after use. It said some of what the attackers did after gaining access resembles intrusions that have been linked to suspected nation-state actors, and assessed with medium confidence that the attackers impersonated the FortiManager to pull configurations from other firewalls. Unit 42 stressed that its investigation covered only the provider's own environment: it did not examine the client networks, and what it documents is the exposure of client firewall configurations and credentials, not a confirmed breach of the client networks themselves.

For defenders, the immediate step is to upgrade affected Fortinet products or migrate branches that have no fix. Unit 42 recommends reviewing FortiOS configuration revisions for auto-script objects whose names contain directory traversal strings, checking crash logs for segmentation faults in the logging, IKE and syslog daemons, looking for unusual executable memory regions in the logging and VPN daemons, and auditing cross-process memory writes between them. The researchers also advised treating credentials and certificates held by a management platform as compromised as soon as the platform is, since that trust material remains valid until rotated. "That compromise also does not end when the platform is patched", Unit 42 wrote.