CVE-2025-61624: PEERSTITCH Malware Abuses a FortiOS Path Traversal Flaw

Fortinet fixed CVE-2025-61624 in April 2026 and labeled it Medium severity. Six months later, on October 16, CISA added it to the Known Exploited Vulnerabilities catalog with a federal due date of October 19, after Palo Alto Networks Unit 42 showed how an attacker had used it during a long intrusion into a telecommunications managed service provider. The flaw is a path traversal in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, and in that intrusion it helped plant PEERSTITCH, a piece of malware that runs only in memory on FortiGate firewalls.

This post covers how the flaw works, what PEERSTITCH does, which versions are fixed, and why a Medium score understates what happened here.

How the flaw works and how it was used

Fortinet describes CVE-2025-61624 as improper limitation of a pathname (CWE-22, path traversal) in the command line interpreter. NVD adds that the attacker must be authenticated with an admin profile and at least read-write permissions, and that specific CLI commands let them write or delete arbitrary files. Unit 42 explains why that matters: the auto-script feature does not sanitize the object name, so a name such as ../../../../setup places a script outside its intended directory, and the script runs with the privileges of the auto-script engine. In practice an administrator account, including super_admin, ends up reading and writing files as root.

That made it a useful second step for an intruder who already had admin access. Unit 42 tracks the activity as cluster CL-STA-0954 (also known as UNC5820) and reports that it began in September 2024 with CVE-2024-47575, the unauthenticated FortiManager flaw known as FortiJump, against a telecommunications managed service provider. From FortiManager the attackers collected configuration and credential material for more than 500 managed FortiGate firewalls, cracked admin and VPN passwords by brute force, and then reached the firewalls themselves. Unit 42 says CVE-2025-61624 was used during this intrusion to run a loader on the firewalls.

The loader fetched five files from a staging server and launched PEERSTITCH, a 64-bit ARM Linux program written in C. Its behavior is what makes the case notable:

• Nothing on disk, nothing listening. PEERSTITCH is a one-shot memory injector. It leaves no persistent binary, opens no listening ports and makes no outbound connections of its own.
• Two trusted daemons. It attaches with ptrace to the logging daemon (miglogd) and the IPsec VPN daemon (iked), allocates a 16 KB executable memory region in each, and patches in hooks.
• A hidden bridge between them. The hooks watch ordinary traffic for two markers, TCP port 8550 and the link-local address 169.254.0.1. When one matches, the session token is passed from one daemon to the other through a ring buffer in memory, and the VPN daemon takes an alternate path that skips its normal session checks.
• A second command channel. Unit 42 observed the attackers abusing the Apache mod_md certificate module with a rogue ACME server, so a certificate challenge launched an SSH reverse shell.
• Cleanup. Logging processes were killed, crash logs cleared, and rogue admin accounts, VPN groups and auto-script objects deleted.

The data taken from FortiManager included the management relationships and running configurations for more than 500 FortiGates, internal topology and routing data, encrypted admin, local and SSL VPN credentials, and certificates and private keys. Unit 42 notes that it did not examine the provider's client networks, so what it confirms is exposure of configuration and credential material, not proven intrusion into those clients.

Who is affected

Fortinet's advisory FG-IR-26-122 covers four products. Several older branches have no fixed release at all, so the only remedy there is to move to a supported branch.

Product	Affected versions	Fixed in
FortiOS 7.6	7.6.0 to 7.6.4	7.6.5 or above
FortiOS 7.4	7.4.0 to 7.4.9	7.4.10 or above
FortiOS 7.2, 7.0, 6.4	All versions	Migrate to a fixed release
FortiPAM 1.7	1.7.0	1.7.1 or above
FortiPAM 1.6 and older	All versions	Migrate to a fixed release
FortiProxy 7.6	7.6.0 to 7.6.4	7.6.5 or above
FortiProxy 7.4	7.4.0 to 7.4.11	7.4.12 or above
FortiProxy 7.2, 7.0	All versions	Migrate to a fixed release
FortiSwitchManager 7.2	7.2.0 to 7.2.7	7.2.8 or above
FortiSwitchManager 7.0	7.0.0 to 7.0.6	7.0.7 or above

FortiPAM 1.8 is not affected. The advisory lists no workaround. It does mention a virtual patch named FG-VD-59270.0day, but a signature is a stopgap, not a replacement for upgrading.

VulnTracker and NVD also list the Siemens RUGGEDCOM APE1808 appliance, with the note that it is affected only when running the affected Fortinet software. The Siemens advisory linked from that page was not opened for this post, so check it directly if you operate that hardware.

The attack needs administrator access, so internet exposure alone does not make a device exploitable. The risk is highest on firewalls whose admin credentials may already have been stolen, which is exactly the situation of the provider in Unit 42's report.

A Medium score with total impact

The same bug was assessed twice, six months apart, and the two readings are far apart. When NVD published the record in April, CISA's SSVC assessment listed exploitation as none and technical impact as partial. VulnTracker now shows the SSVC decision as Active exploitation, not automatable, and total technical impact. Nothing about the code changed. What changed is that someone showed what an attacker can do with it.

The base score never carried that information. Fortinet rates the flaw 6.0 with a local attack vector, NVD rates it 6.5 with a network vector, and VulnTracker displays the NVD figure. Some coverage quotes 5.4, which is Fortinet's temporal score, not its base score. All of these sit in the Medium band because the vector requires high privileges, and a scanner or a policy that only patches High and Critical items would have left this one for later. EPSS tells the same story: 0.6% on the page, a very low chance of broad exploitation, while the flaw was already part of a confirmed intrusion.

The privilege requirement is the part to rethink. It lowers the score because it assumes admin access is hard to get. In the case Unit 42 describes, admin access was the thing the attackers had already collected, through a FortiManager flaw and cracked passwords. For them, this CVE was the step from admin to root, and from root to a memory-only implant inside the VPN daemon that left almost nothing for ordinary tools to find.

Timing is the last point. Fortinet published the fix on April 14, and CISA added the flaw to KEV on October 16, about six months later. Anyone who ranked patches by score alone had half a year in which this one looked optional.

Reading it on VulnTracker

The CVE-2025-61624 page carries three CVSS 3.1 entries, one each from Fortinet's PSIRT, NVD and Fortinet as CNA. The default view is the NVD one: 6.5 Medium, network vector, high privileges required, no user interaction, high integrity and availability impact. The page flags the exploitation status in a red Actively Exploited panel, which comes from the CISA KEV catalog.

Inside that panel, KEV shows the flaw added on October 16, 2026, with remediation due October 19, 2026, which at the time of writing is two days away for federal agencies. The EPSS score is 0.6%. The SSVC line reads Active, Not automatable, Total impact, and it is the one to sort by here, because it describes what the bug does in the hands of an attacker, which the Medium CVSS number does not. The weakness is CWE-22, and the affected platforms table follows Fortinet's version ranges, with the Siemens RUGGEDCOM entry marked as affected only when it runs those products.

What to do now

1. Upgrade to a fixed release. Use the table above and Fortinet's upgrade tool. If you run FortiOS 7.2, 7.0 or 6.4, FortiPAM 1.6 or older, or FortiProxy 7.2 or 7.0, there is no patch for your branch, so plan the move to a supported one.
2. Reduce who can log in. Limit management access to trusted hosts, remove admin accounts you cannot explain, and require multi-factor authentication for administrators. The flaw needs an admin session, so every admin account you close is one less way in.
3. Check FortiManager too. The intrusion began with CVE-2024-47575 against FortiManager, so confirm it is patched and that its FMG-Access port, TCP 541, is not reachable from the internet. Unit 42 notes that Palo Alto IPS signatures 95788 and 96788 block that earlier flaw.
4. Hunt for what Unit 42 described. Look for FortiManager registrations or admin accounts you did not create, VPN groups you did not define, auto-script objects whose names contain ../, and crash logs showing signal 11 for miglogd, iked or syslogd. On devices where you can inspect memory, look for 16,384-byte anonymous read-write-execute regions in those processes.
5. Match the network and file indicators. Unit 42 names 23.240.77[.]233 as the server the loader downloaded from, and its report carries the full table of staging addresses and SHA-256 hashes. Check your firewall logs and egress records against that table. Because PEERSTITCH lives in memory, a clean file scan proves little.
6. If you find a match, treat the secrets as burned. Unit 42 says organizations should treat the credentials and certificates held by affected interfaces as compromised. Rotate admin and VPN credentials, reissue certificates and keys, and follow CISA's BOD 26-04 forensics guidance, which the KEV entry points to, before you rebuild.

Keep in mind that the attackers cleared logs and crash records, so the absence of alerts is not a clean result.

Takeaway

CVE-2025-61624 shows how little a Medium label says about a flaw once an attacker already holds an admin account. If you run FortiGate, FortiProxy, FortiPAM or FortiSwitchManager, upgrade this week, then check your admin accounts and VPN configuration for anything you did not create. If you want to know whether this CVE, or similar flaws in the Fortinet products you run, affect your environment, you can track it on VulnTracker and get its KEV status, SSVC decision and affected versions in one place.

References

Vendor: Fortinet advisory FG-IR-26-122. NVD: CVE-2025-61624. Analysis: Palo Alto Networks Unit 42, PEERSTITCH and CVE-2024-47575, The Hacker News and Cyber Security News.