The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to deal with an exploited path-traversal vulnerability in several Fortinet products, and the deadline is today. On October 16, CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities (KEV) catalog with a due date of 2026-10-19. The entry also marks the flaw as requiring forensic triage, not only patching.
Three days after the KEV listing, research from Palo Alto Networks, reported by SecurityWeek, linked the vulnerability to a long-term intrusion at an unnamed telecommunications organization. According to Palo Alto, the attacker in that intrusion deployed a memory-resident FortiGate implant that the company calls PeerStitch.
The flaw affects FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. Fortinet patched it in April 2026 and lists it as known exploited. Several older product branches have no fix and must be migrated to a supported release.
What the flaw does
CISA's KEV entry, titled "Fortinet Multiple Products Path Traversal Vulnerability," describes the bug this way: FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager "contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands." It is classified as CWE-22 (path traversal).
Fortinet's advisory, FG-IR-26-122 ("Path Traversal in CLI"), was published on April 14, 2026. It rates the issue Medium, with a CVSSv3 base score of 6.0 (temporal 5.4), and lists the impact as escalation of privilege. The score is moderate because the attacker must already be authenticated with a privileged administrative profile, and an attacker with that level of access already controls the device in many respects.
Being able to write or delete arbitrary files, though, goes beyond what a CLI administrator is supposed to be able to do. According to Palo Alto's findings as reported by SecurityWeek, the attacker in the telecom intrusion used the flaw to gain root access to the firewall's operating system. SecurityWeek also reports that the bug was exploited as a zero-day, and Fortinet's advisory marks it "Known exploited: Yes." For defenders, the CVSS score matters less here than the fact that the bug was exploited before a patch existed.
A timeline of the telecom intrusion
Palo Alto's findings, as SecurityWeek reported them, describe a chain of Fortinet vulnerabilities used against the telecom organization. SecurityWeek reports that Palo Alto attributes the activity to a suspected state-sponsored threat actor named UNC5820, which Palo Alto tracks as CL-STA-0954. That attribution comes from Palo Alto, and the name UNC5820 was first used by Mandiant. Neither CISA's KEV entry nor Fortinet's advisory attributes exploitation of CVE-2025-61624 to a specific actor.
- June 2024 (at the latest): According to Mandiant, cited by SecurityWeek, UNC5820 had been exploiting the FortiManager flaw CVE-2024-47575 since at least this month. The flaw is a critical remote code execution vulnerability, and Mandiant named it "FortiJump."
- September 2024: The telecom intrusion takes place. Palo Alto says the attacker gained initial access through FortiJump against the victim's central FortiManager and kept access over the long term.
- October 2024: Fortinet patches CVE-2024-47575 after it was exploited as a zero-day.
- During the intrusion: SecurityWeek reports that the attacker exfiltrated a configuration archive covering the FortiManager, more than 500 managed FortiGate firewalls, and the victim's network. To impersonate the legitimate FortiManager, the attacker either ended its session by exploiting CVE-2024-26008 or reused exfiltrated secrets.
- April 14, 2026: Fortinet publishes FG-IR-26-122, patching CVE-2025-61624 and flagging it as exploited.
- October 16, 2026: CISA adds CVE-2025-61624 to the KEV catalog with a due date of October 19 and a forensic-triage requirement.
- October 19, 2026: SecurityWeek publishes Palo Alto's findings linking the vulnerability to the telecom intrusion and the PeerStitch implant.
PeerStitch: an implant built to stay quiet
The reporting gives a few technical details about PeerStitch, and they explain why it would be hard to find. Palo Alto describes it as an ARM64 implant written in C that runs in memory on FortiGate devices. The company calls it a "one-shot process memory patching injector" that targets FortiOS daemons for central management, traffic logging, and the IKE/IPsec VPN service. It sets up a covert, memory-resident communication bridge between those processes and bypasses default FortiOS security checks. It opens no listening ports and makes no outbound connections of its own. Instead, it communicates through traffic that legitimate processes already generate. SecurityWeek also reports that the attackers took steps to remove forensic artifacts.
Much network-device threat hunting depends on spotting unexpected listeners, unusual outbound beacons or new files on disk. An implant that does none of these can get past all three checks. Palo Alto said the implant shows "the increasing technical maturity of edge-device malware." It also explains why CISA's KEV entry calls for forensic triage on top of the patch. Updating firmware closes the vulnerability, but it does not tell an organization whether an attacker has already been on the device.
Public reporting does not say whether the same attacker exploited CVE-2025-61624 at other organizations. CISA lists the flaw's known use in ransomware campaigns as "Unknown."
Affected and fixed versions
The fixed releases below are taken from Fortinet's advisory FG-IR-26-122:
- FortiOS 7.6.0 through 7.6.4: upgrade to 7.6.5 or above.
- FortiOS 7.4.0 through 7.4.9: upgrade to 7.4.10 or above.
- FortiOS 7.2, 7.0 and 6.4 (all versions): migrate to a fixed release.
- FortiPAM 1.7.0: upgrade to 1.7.1 or above.
- FortiPAM 1.0 through 1.6: migrate to a fixed release. FortiPAM 1.8 is not affected.
- FortiProxy 7.6.0 through 7.6.4: upgrade to 7.6.5 or above.
- FortiProxy 7.4.0 through 7.4.11: upgrade to 7.4.12 or above.
- FortiProxy 7.2 and 7.0: migrate to a fixed release.
- FortiSwitchManager 7.2.0 through 7.2.7: upgrade to 7.2.8 or above.
- FortiSwitchManager 7.0.0 through 7.0.6: upgrade to 7.0.7 or above.
Fortinet also lists a virtual patch, FG-VD-59270.0day, delivered in FMWP database update 25.120. Organizations on the "migrate" branches should not treat a virtual patch as a permanent fix. Those branches will not get a code fix for this issue.
What It Means for Defenders
Check the deadline. CISA's due date for CVE-2025-61624 is October 19, 2026. Federal civilian agencies bound by the directive referenced in the entry (BOD 26-04) should already be acting. Other organizations should treat the KEV listing as evidence of real exploitation, not just a compliance date.
Patch or migrate. Move affected FortiOS, FortiProxy, FortiPAM and FortiSwitchManager devices to the fixed versions listed above. Systems running FortiOS 7.2, 7.0 or 6.4, FortiProxy 7.2 or 7.0, or FortiPAM 1.0 through 1.6 need a migration plan, not a point update. If an upgrade has to wait, check whether the FG-VD-59270.0day virtual patch is deployed in your environment.
Do the forensic triage. CISA's required action points to its Forensics Triage Requirements. The PeerStitch reporting shows why that step matters. An implant that lives in memory and generates no network traffic of its own will not show up in routine checks, and patching alone does not remove it. Follow CISA's triage guidance for the affected devices, and watch for indicators of compromise published by Fortinet and Palo Alto Networks.
Review administrative access. Exploiting this flaw requires an authenticated admin with at least read-write permissions. Audit which accounts hold those profiles and remove ones that are unnecessary. Rotate administrator credentials on affected devices, especially devices that could have been reached during a compromise. Limit management-interface access to trusted networks.
Look at FortiManager too. According to Palo Alto, the attacker got in through FortiJump (CVE-2024-47575). To impersonate the legitimate FortiManager, the attacker then either exploited CVE-2024-26008 or reused secrets taken from exfiltrated configurations. Organizations that ran exposed or unpatched FortiManager instances in 2024 should confirm those systems are patched and rotate secrets stored in FortiManager configurations. They should also check whether managed FortiGate devices show signs of tampering that began before the April 2026 fix.
On October 16, CISA added one other vulnerability to the catalog: BeyondTrust's CVE-2026-102764, an authentication bypass in Remote Support. It has the same due date and the same forensic-triage requirement.
