Attackers have been exploiting a FortiOS flaw that Fortinet patched in April, and on October 16 the U.S. government added it to its list of vulnerabilities known to be actively exploited. The same day, Palo Alto Networks' Unit 42 published details of the implant that follows the break-in, a stealthy malware it calls PEERSTITCH. The bug is not new. What makes this urgent is the gap between a six-month-old fix and the FortiGate firewalls and VPN gateways that still run older code.
What CISA added to its KEV catalog
CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on October 16, 2026. The same alert listed a BeyondTrust flaw, CVE-2026-102764. KEV is CISA's running list of flaws with evidence of active exploitation. Federal civilian agencies must act on KEV entries under the agency directive BOD 26-04, and CISA's KEV guidance asks every organization, not only federal agencies, to prioritize them.
According to The Hacker News and a CIS security advisory, the flaw is a path traversal in the command-line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. A privileged attacker can use it to write or delete arbitrary files. That is a powerful capability, and it explains why attackers want administrative access first.
The alert text available for this story did not list a federal remediation due date for this entry. Agencies should check the live KEV record for a deadline, and private operators should not wait for one before acting.
KEV additions often arrive in batches. USA 24 has reported how a China-linked group exploited a BeyondTrust zero-day for seven weeks. A separate AhsayCBS flaw under attack carries a federal deadline of October 17.
How attackers turn admin access into root
Unit 42 reported that attackers used the flaw to move from FortiOS administrative access to root on the firewall's underlying operating system. That step matters. Root access gives an attacker the reach to place code inside the services PEERSTITCH targets, and to read secrets that normal admin accounts never display.
Unit 42 also says one compromised appliance yielded an archive with running configurations, cryptographic material and database files covering more than 500 managed FortiGate firewalls. For an enterprise or managed service provider, that turns a single device into a map of many. Keys and configurations tend to outlive the intrusion that stole them, so rotation matters as much as patching.
The sequence also involved what Unit 42 describes as a FortiManager-linked intrusion. The sources reviewed for this story do not confirm whether that intrusion and the PEERSTITCH deployment are the same operation.
Greenbone and Unit 42 both point to prior high-level access or stolen credentials as likely starting points. That makes this flaw a second-stage tool. Strong administrator passwords and tightly controlled admin access are the first line of defense, even before the patch goes on.
Inside PEERSTITCH, the implant that leaves little to find
The Hacker News described PEERSTITCH as previously unreported, memory-resident malware for ARM64 systems, and attributed its delivery to a suspected advanced threat actor. Unit 42 says it runs inside FortiGate's logging and VPN daemons. According to a summary of that research, PEERSTITCH leaves no disk artifacts, opens no listening ports and makes no outbound connections.
That profile is what makes the malware hard to catch. A file-based scan may come back clean, and a port scan will show nothing unusual. Defenders need to look at configuration, admin accounts and VPN session records instead, which is why the checklist below focuses there.
Neither source names a group or country behind the activity, and no count of compromised organizations appears in the sources. The sources also contain an April 2026 mention of PEERSTITCH alongside the CVE disclosure, but the detailed analysis dates from October. Treat claims about victims or attribution with caution until Unit 42 or Fortinet publishes more.
Which FortiGate versions need the fix
Fortinet patched CVE-2025-61624 in April 2026, and the vulnerability record was published April 14, 2026, according to a database mirror of the record. The first fixed releases listed are FortiOS 7.4.10 and 7.6.5, per cybersecurity-help.cz. Affected ranges reported by Strix include the versions below.
| Product | Affected versions reported | First fixed release reported |
|---|---|---|
| FortiOS | 6.4.0 through 7.4.9; 7.6.0 through 7.6.4 | 7.4.10 and 7.6.5 |
| FortiProxy | 7.0 through 7.6.4 | Not confirmed in the sources reviewed; check Fortinet's advisory |
Severity scores do not agree. The Hacker News lists 5.4, Greenbone lists 6.0, and NVD-derived records show 6.5. Use the score in Fortinet's advisory or NVD as the reference. The KEV listing carries more weight than the number, because it confirms exploitation.
How the FortiBleed warning fits in
On October 6, the FBI and Secret Service flagged FortiBleed, a credential-driven campaign against FortiGate devices. According to Cybersecurity Dive and Infosecurity Magazine, attackers reuse stolen credentials and crack password hashes offline. They then create new admin accounts or change passwords to lock owners out.
The agencies cited a SOCRadar count of more than 86,644 compromised FortiGate devices across 194 countries. They also linked the campaign to ransomware affiliates, naming the INC, Lynx and Payload groups.
Both threats target admin access on FortiGate appliances. The sources reviewed for this story do not establish that the CVE-2025-61624 activity is part of FortiBleed, so treat them as separate threats that call for overlapping checks.
Fortinet has had other exploited products this year. CISA added a FortiMail zero-day, CVE-2026-104286 with a CVSS score of 9.8, to KEV on October 1 with an October 4 deadline. The Register reported that Fortinet's advisory says the flaw "is being exploited in the wild." Teams running FortiGate, FortiMail or FortiProxy should expect Fortinet to remain a repeat target.
What to do this week
If you run FortiGate firewalls, FortiOS VPNs, FortiProxy or FortiPAM, work through these steps in order.
- Confirm the running version on every device, then upgrade to a fixed release. For FortiOS, start with 7.4.10 or 7.6.5, and check Fortinet's advisory for other branches and products.
- Review administrator accounts, API keys and active VPN sessions. Remove any entry you cannot account for, and rotate keys that may have been exposed.
- Restrict management interfaces to trusted hosts, so administrative access is never reachable from the open internet, as the FBI and Secret Service advice recommends.
- Rotate administrator passwords and review privileged credentials and insider access, especially if you see unexpected password changes or lockouts.
- Look for persistence. The FBI and Secret Service pointed to CISA's Eviction Strategies Tool for removing attacker footholds, as reported here.
- Review access to FortiManager and any stored configuration backups, since Unit 42 describes configuration and key material being taken from one appliance.
Signs that a device may already be compromised include admin accounts you did not create, changed admin passwords, unexpected VPN sessions and logins from unfamiliar addresses. If you find any of these, treat the device as compromised and bring in your incident response team. Reapplying a patch does not remove an attacker who is already inside.
What comes next
Several answers remain open. The sources do not identify who runs PEERSTITCH, how many organizations were hit, or whether the FortiManager intrusion is the same operation. CISA has not shown a federal deadline in the alert text reviewed for this story, and Fortinet's advisory or NVD should settle the severity score.
Patch queues are already heavy. Microsoft's October Patch Tuesday fixed a record 1,413 CVEs, as USA 24 reported, so security teams have less room than usual to triage a Fortinet fix. Expect more edge-device entries in the KEV catalog, and expect attackers to keep chasing the admin access that makes those devices useful to them.
