Spies Turned a 'Medium' Firewall Bug Into Root

Fortinet rated this bug medium: 6.0 out of 10, and only exploitable by someone who is already an administrator. Attackers used it to get root on the firewall, then hid a spy implant inside the firewall's own logging and VPN processes, where it left no file on disk and opened no port of its own.

The victim was a telecom managed service provider, the kind of company that runs firewalls for dozens of other companies. If you manage edge devices for clients, this one is about you.

TL;DR

• CVE-2025-61624 is a path traversal flaw in the command-line interface of Fortinet FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. An authenticated admin can use it to write or delete any file on the device, which in practice means root.
• CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on October 16, 2026 and gave federal agencies until October 19 to patch. Fortinet fixed it in April 2026 (advisory FG-IR-26-122).
• Palo Alto Networks Unit 42 reports that a suspected advanced threat actor (CL-STA-0954 / UNC5820) chained it with the FortiManager "FortiJump" flaw (CVE-2024-47575) to deploy a memory-only implant called PEERSTITCH.
• What to do: upgrade to FortiOS 7.6.5 / 7.4.10 or later (7.2, 7.0 and 6.4 need to move to a fixed branch), get FortiManager and firewall admin interfaces off the internet, and rotate every credential and certificate your management platform has ever stored.

What is CVE-2025-61624?

CVE-2025-61624 is a path traversal bug (CWE-22) in the CLI of Fortinet FortiOS and three sibling products. It lets a privileged user write or delete arbitrary files by passing crafted arguments to normal commands. "Path traversal" means sneaking ../ ("go up one folder") into a filename so the file ends up somewhere it was never supposed to go.

Unit 42 found the weak spot in FortiOS's auto-script feature, which lets admins schedule CLI scripts. The script's name isn't sanitized. Name a script ../../../../setup and FortiOS writes your script to that location on the underlying operating system, as root.

Think of a hotel that lets managers store luggage in the back room. Nobody checks the tag, so a manager writes "back room → down the hall → the vault" on the tag and the bellhop carries it straight into the vault.

Fortinet scores it 6.0 base (5.4 temporal) because it needs admin credentials first. The catch is that attackers who steal firewall admin passwords are common.

How did attackers actually use it?

According to Unit 42's October 14, 2026 report, the attackers used CVE-2025-61624 as the privilege-escalation step in a long intrusion against a telecom MSP. Unit 42 says the intrusion began in September 2024. The chain went like this:

1. Break into the management console. They exploited FortiJump (CVE-2024-47575), an unauthenticated flaw in FortiManager's device-management channel on TCP 541, and registered a fake FortiGate.
2. Steal the keys to everything. They pulled an archive holding the running configurations of more than 500 FortiGate firewalls, including firewalls protecting the MSP's clients. It also held serial-number-to-public-IP inventories, routing data, certificates, private keys and recoverable admin and SSL VPN passwords.
3. Walk in the front door. Unit 42 says they cracked those passwords and logged in over SSL VPN like ordinary users.
4. Turn admin into root. With admin access, they abused the auto-script traversal in CVE-2025-61624 to drop the PEERSTITCH loader onto the firewall.
5. Cover their tracks. They killed logging daemons, cleared crash logs and deleted the rogue admins and scripts after use.

Unit 42 also documented a second backdoor that abused the firewall's Apache mod_md certificate module. A rogue certificate authority made the device spawn an SSH reverse shell every time it "renewed" a certificate.

What is PEERSTITCH?

PEERSTITCH is a memory-resident ARM64 implant that injects code into two FortiOS daemons: miglogd (logging) and iked (IPsec VPN). Once inside, it watches traffic for secret markers and tags matching VPN sessions. Unit 42 says those tagged sessions then skip default FortiOS security checks.

The unsettling line from the researchers:

"PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections."

So it doesn't show up as a new file, a new open port or odd outbound traffic. It hides in processes that are supposed to be on the firewall.

Am I affected by CVE-2025-61624?

You, or any client whose firewall you manage, are affected if a device runs FortiOS 7.6.0–7.6.4, 7.4.0–7.4.9, or any 7.2, 7.0 or 6.4 release; FortiProxy 7.6.0–7.6.4, 7.4.0–7.4.11, or any 7.2/7.0; FortiPAM 1.0–1.7.0; or FortiSwitchManager 7.2.0–7.2.7 or 7.0.0–7.0.6, per Fortinet's advisory FG-IR-26-122.

The bigger question is whether anyone else already has your admin credentials. Ask:

• Is FortiManager, or any FortiGate admin interface, reachable from the internet? That includes TCP 541 and the HTTPS management page.
• Did you ever run a FortiManager that was vulnerable to FortiJump? If so, assume its stored configurations, and every password in them, were exposed.
• Do SSL VPN accounts use only a password? Stolen passwords are how this crew got in.

How do I fix it, and how do I check for compromise?

Upgrade first: FortiOS 7.6.5+ or 7.4.10+, FortiProxy 7.6.5+ or 7.4.12+, FortiPAM 1.7.1+, FortiSwitchManager 7.2.8+ or 7.0.7+. Branches 6.4, 7.0 and 7.2 have no fix, so migrate. Fortinet also ships an IPS virtual patch (FG-VD-59270.0day) as a stopgap.

Patching closes the door but doesn't evict anyone already inside. Then:

1. Search config revisions for auto-script objects whose names contain ../. Unit 42 lists that as a direct indicator.
2. Look for unexplained crashes of miglogd, iked or syslogd, and gaps in logging.
3. Check Apache mod_md / ACME settings for configs you didn't create.
4. Rotate everything a compromised management platform touched: admin and VPN passwords, certificates and private keys. As Unit 42 puts it, stolen trust material "remains valid until it is rotated."
5. Put MFA on SSL VPN and admin logins, and restrict management to a dedicated network.

If you find indicators, don't just reboot and hope. Bring in incident response; this actor is good at deleting evidence.

Why this matters for MSPs

The lesson is that one management console can expose hundreds of downstream firewalls. One FortiManager gave the attackers configs, credentials and network maps for more than 500 FortiGates, including firewalls guarding the MSP's clients. Unit 42 hasn't confirmed that client networks were breached, but the exposure alone is a nightmare.

It also shows why "medium" severity can be misleading. CVSS scores a bug on its own. Real attackers chain bugs, and a medium privilege escalation after a stolen password is just the next step.

Where KinoSec fits

KinoSec runs autonomous penetration tests against external networks, web apps and Active Directory, and it chains findings the way this attacker did. A KinoSec external pentest of your clients' perimeters would flag:

• Exposed management surfaces: FortiManager on TCP 541, FortiGate admin pages and SSL VPN portals that answer from the internet.
• Version and patch exposure: devices whose fingerprints match versions affected by CVE-2025-61624, FortiJump or other KEV-listed Fortinet bugs.
• The credential path in: weak or reused VPN and admin passwords, and missing MFA. That's the step this whole chain depended on.

To be clear about scope: KinoSec won't scan firewall process memory for PEERSTITCH. That's work for forensics and incident response. What it does is find the exposed console, the unpatched version and the weak login that let this attack start, and write them up in a plain-language report you deliver to your client under your own brand. You can run it across every client on a schedule, so the next KEV entry doesn't wait for the annual test.

Frequently Asked Questions

Is CVE-2025-61624 being exploited in the wild?

Yes. CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on October 16, 2026, and Fortinet's advisory FG-IR-26-122 marks it as exploited. Unit 42 documented the threat cluster CL-STA-0954 (UNC5820) using it to get root on FortiGate firewalls and deploy the PEERSTITCH implant.

Why is CVE-2025-61624 rated medium if attackers used it for root?

CVE-2025-61624 scores 6.0 (CVSS v3 base) because it requires an authenticated administrator with read-write rights. In the attack Unit 42 documented, the attackers got those admin credentials by stealing them from a compromised FortiManager first. Chained after a credential theft, a medium-rated bug can still give an attacker full control of the device.

What versions fix the Fortinet CVE-2025-61624 path traversal?

Fortinet fixed CVE-2025-61624 in FortiOS 7.6.5 and 7.4.10, FortiProxy 7.6.5 and 7.4.12, FortiPAM 1.7.1, and FortiSwitchManager 7.2.8 and 7.0.7. FortiOS 7.2, 7.0 and 6.4 (and FortiProxy 7.2 and 7.0) have no patched release, so those devices need to move to a fixed branch.

What is PEERSTITCH malware?

PEERSTITCH is a memory-resident ARM64 implant for FortiGate firewalls, disclosed by Palo Alto Networks Unit 42 in October 2026. It injects code into the FortiOS miglogd and iked daemons and tags VPN sessions so they skip default security checks. It writes no persistent file, opens no ports and makes no outbound connections of its own, so it is hard to detect.

Does patching CVE-2025-61624 remove an existing compromise?

No. Patching blocks new exploitation of CVE-2025-61624 but doesn't remove an attacker who is already inside or invalidate credentials they stole. After upgrading, check for auto-script objects with ../ in their names, rotate admin and VPN passwords, certificates and keys, and bring in incident response if you find indicators.