Fortinet: a flaw patched in April was used to hide an implant deep inside FortiGate firewalls

Fortinet rated it "medium" severity. Scored 6 out of 10, the CVE-2025-61624 vulnerability requires an administrator account to be exploited. Yet it allowed attackers to plant an almost invisible implant deep inside FortiGate firewalls.

On October 16, 2026, the US cybersecurity agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog. Fortinet had patched it back on April 14, in its advisory FG-IR-26-122, and lists it there as exploited. It is a directory traversal in the command-line interface of FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. According to Fortinet, an attacker with elevated privileges could use it to write or delete any file.

Which versions to install

• FortiOS: 7.6.5 or later, 7.4.10 or later. Branches 7.2, 7.0 and 6.4 will not be patched: you must move to a maintained branch.
• FortiProxy: 7.6.5 or 7.4.12 and later. Branches 7.2 and 7.0 must be abandoned.
• FortiPAM: 1.7.1 and later. Branch 1.8 is not affected.
• FortiSwitchManager: 7.2.8 or 7.0.7 and later.

Until you can update, Fortinet offers a virtual patch ("FG-VD-59270.0day") in update 25.120 of its FMWP database.

How a small flaw opens the door to the system

On October 14, researchers at Unit 42, the threat intelligence team of Palo Alto Networks (a Fortinet competitor), described how it was used. According to them, the victim is an IT services provider in the telecom sector, whose intrusion dates back to September 2024.

The attackers reportedly first got in through an older FortiManager flaw (CVE-2024-47575). FortiManager is the console that administers fleets of firewalls. They allegedly collected configurations, certificates and passwords encrypted in a reversible way. With these credentials, they reportedly opened SSL VPN sessions on the firewalls, then, according to Unit 42 (with medium confidence), sent their commands while posing as the management console.

This is where CVE-2025-61624 comes in. The name of an automation script was not filtered: slipping in a ../ sequence made it possible to place a file outside its directory, with root privileges. The attackers dropped PEERSTITCH there, an implant that injects itself into the memory of two FortiOS services, leaves no persistent binary on disk and opens no port. According to Unit 42, it lets certain flagged VPN connections evade security controls. The configurations of more than 500 firewalls, protecting the provider and its customers, were reportedly stolen; Unit 42 says it did not examine those customers' networks.

What to check on your FortiGate devices

This is not a spectacular attack: stolen credentials, then a "medium" flaw to become root. Patching is therefore not enough if the management console may have been compromised. Unit 42 recommends that you:

• search the configuration history for automation scripts whose name contains ../;
• watch the logs for crashes (signal 11) of the miglogd, iked or syslogd services;
• change passwords and renew certificates stored in FortiManager if it has been exposed;
• isolate management interfaces as much as possible.

Unit 42 also publishes a YARA detection rule in its report. As with the PAN-OS flaw disclosed on October 15, the requirement to have an administrator account offers little protection when those accounts are already in the wrong hands. The actor behind the campaign has not been formally identified.