# CISA Flags Fortinet CVE-2025-61624 as Exploited Alongside PEERSTITCH

- URL: https://usa-24.com/cve-2025-61624-fortios-attack-patch/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-16T21:37:58.398Z
- Updated: 2026-10-16T21:37:58.407Z
- Topics: Fortinet, FortiGate, Known Exploited Vulnerabilities, Firewall Security, PEERSTITCH

> CISA added Fortinet's CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on October 16, the same day researchers disclosed the PEERSTITCH implant that attackers delivered through it.

## Key takeaways

- CISA added CVE-2025-61624, a path traversal flaw in FortiOS and related Fortinet products, to its Known Exploited Vulnerabilities catalog on October 16, 2026.
- Fortinet patched the flaw in April 2026, and the first fixed releases listed are FortiOS 7.4.10 and 7.6.5.
- Unit 42 says attackers used the flaw to escalate from FortiOS administrative access to root and then deploy PEERSTITCH, a memory-resident implant.
- One compromised appliance yielded configuration and cryptographic data covering more than 500 managed FortiGate firewalls, according to Unit 42.
- Severity scores disagree across sources, with 5.4, 6.0 and 6.5 all in circulation, so check Fortinet's advisory or NVD before relying on a number.

Attackers have been exploiting a FortiOS flaw that Fortinet patched in April, and on October 16 the U.S. government added it to its list of vulnerabilities known to be actively exploited. The same day, Palo Alto Networks' Unit 42 published details of the implant that follows the break-in, a stealthy malware it calls PEERSTITCH. The bug is not new. What makes this urgent is the gap between a six-month-old fix and the FortiGate firewalls and VPN gateways that still run older code.

## What CISA added to its KEV catalog

CISA added CVE-2025-61624 to its [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog) on October 16, 2026. The same alert listed a BeyondTrust flaw, CVE-2026-102764. KEV is CISA's running list of flaws with evidence of active exploitation. Federal civilian agencies must act on KEV entries under the agency directive BOD 26-04, and CISA's KEV guidance asks every organization, not only federal agencies, to prioritize them.

According to [The Hacker News](https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html) and a [CIS security advisory](https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-035), the flaw is a path traversal in the command-line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. A privileged attacker can use it to write or delete arbitrary files. That is a powerful capability, and it explains why attackers want administrative access first.

The alert text available for this story did not list a federal remediation due date for this entry. Agencies should check the live KEV record for a deadline, and private operators should not wait for one before acting.

KEV additions often arrive in batches. USA 24 has reported how a [China-linked group exploited a BeyondTrust zero-day for seven weeks](https://usa-24.com/beyondtrust-zero-day-remote-support-attack/). A separate [AhsayCBS flaw under attack](https://usa-24.com/ahsaycbs-vulnerability-backup-server-attack/) carries a federal deadline of October 17.

## How attackers turn admin access into root

[Unit 42 reported](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/) that attackers used the flaw to move from FortiOS administrative access to root on the firewall's underlying operating system. That step matters. Root access gives an attacker the reach to place code inside the services PEERSTITCH targets, and to read secrets that normal admin accounts never display.

Unit 42 also says one compromised appliance yielded an archive with running configurations, cryptographic material and database files covering more than 500 managed FortiGate firewalls. For an enterprise or managed service provider, that turns a single device into a map of many. Keys and configurations tend to outlive the intrusion that stole them, so rotation matters as much as patching.

The sequence also involved what Unit 42 describes as a FortiManager-linked intrusion. The sources reviewed for this story do not confirm whether that intrusion and the PEERSTITCH deployment are the same operation.

Greenbone and Unit 42 both point to prior high-level access or stolen credentials as likely starting points. That makes this flaw a second-stage tool. Strong administrator passwords and tightly controlled admin access are the first line of defense, even before the patch goes on.

## Inside PEERSTITCH, the implant that leaves little to find

The Hacker News described PEERSTITCH as previously unreported, memory-resident malware for ARM64 systems, and attributed its delivery to a suspected advanced threat actor. Unit 42 says it runs inside FortiGate's logging and VPN daemons. According to a summary of that research, PEERSTITCH leaves no disk artifacts, opens no listening ports and makes no outbound connections.

That profile is what makes the malware hard to catch. A file-based scan may come back clean, and a port scan will show nothing unusual. Defenders need to look at configuration, admin accounts and VPN session records instead, which is why the checklist below focuses there.

Neither source names a group or country behind the activity, and no count of compromised organizations appears in the sources. The sources also contain an April 2026 mention of PEERSTITCH alongside the CVE disclosure, but the detailed analysis dates from October. Treat claims about victims or attribution with caution until Unit 42 or Fortinet publishes more.

## Which FortiGate versions need the fix

Fortinet patched CVE-2025-61624 in April 2026, and the vulnerability record was published April 14, 2026, according to [a database mirror of the record](https://vulners.com/thn/THN:6D627888E0C0F5109239697449EE0AF6). The first fixed releases listed are FortiOS 7.4.10 and 7.6.5, per [cybersecurity-help.cz](https://www.cybersecurity-help.cz/vdb/soft/fortinet/fortios/7.0.16/). Affected ranges reported by [Strix](https://www.strix.ai/cve/CVE-2025-61624) include the versions below.

| Product | Affected versions reported | First fixed release reported |
|---|---|---|
| FortiOS | 6.4.0 through 7.4.9; 7.6.0 through 7.6.4 | 7.4.10 and 7.6.5 |
| FortiProxy | 7.0 through 7.6.4 | Not confirmed in the sources reviewed; check Fortinet's advisory |

Severity scores do not agree. [The Hacker News](https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html) lists 5.4, [Greenbone](https://www.greenbone.net/en/blog/fortinet-rce-vulnerabilities-2026-critical-vulnerabilities-in-fortisandbox/) lists 6.0, and NVD-derived records show 6.5. Use the score in Fortinet's advisory or NVD as the reference. The KEV listing carries more weight than the number, because it confirms exploitation.

## How the FortiBleed warning fits in

On October 6, the FBI and Secret Service flagged FortiBleed, a credential-driven campaign against FortiGate devices. According to [Cybersecurity Dive](https://www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/) and [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/fbi-secret-service-fortibleed/), attackers reuse stolen credentials and crack password hashes offline. They then create new admin accounts or change passwords to lock owners out.

The agencies cited a SOCRadar count of more than 86,644 compromised FortiGate devices across 194 countries. They also linked the campaign to ransomware affiliates, naming the INC, Lynx and Payload groups.

Both threats target admin access on FortiGate appliances. The sources reviewed for this story do not establish that the CVE-2025-61624 activity is part of FortiBleed, so treat them as separate threats that call for overlapping checks.

Fortinet has had other exploited products this year. CISA added a FortiMail zero-day, CVE-2026-104286 with a CVSS score of 9.8, to KEV on October 1 with an October 4 deadline. [The Register](https://www.theregister.com/security/2026/10/02/fortinet-sounds-the-alarm-over-actively-exploited-fortimail-zero-day/5300803) reported that Fortinet's advisory says the flaw "is being exploited in the wild." Teams running FortiGate, FortiMail or FortiProxy should expect Fortinet to remain a repeat target.

## What to do this week

If you run FortiGate firewalls, FortiOS VPNs, FortiProxy or FortiPAM, work through these steps in order.

- Confirm the running version on every device, then upgrade to a fixed release. For FortiOS, start with 7.4.10 or 7.6.5, and check Fortinet's advisory for other branches and products.
- Review administrator accounts, API keys and active VPN sessions. Remove any entry you cannot account for, and rotate keys that may have been exposed.
- Restrict management interfaces to trusted hosts, so administrative access is never reachable from the open internet, as [the FBI and Secret Service advice](https://www.infosecurity-magazine.com/news/fbi-secret-service-fortibleed/) recommends.
- Rotate administrator passwords and review privileged credentials and insider access, especially if you see unexpected password changes or lockouts.
- Look for persistence. The FBI and Secret Service pointed to CISA's Eviction Strategies Tool for removing attacker footholds, as [reported here](https://windowsforum.com/news/fbi-fortibleed-warning-secure-fortigate-vpns-against-credential-theft-and-ransomware.447496/).
- Review access to FortiManager and any stored configuration backups, since Unit 42 describes configuration and key material being taken from one appliance.

Signs that a device may already be compromised include admin accounts you did not create, changed admin passwords, unexpected VPN sessions and logins from unfamiliar addresses. If you find any of these, treat the device as compromised and bring in your incident response team. Reapplying a patch does not remove an attacker who is already inside.

## What comes next

Several answers remain open. The sources do not identify who runs PEERSTITCH, how many organizations were hit, or whether the FortiManager intrusion is the same operation. CISA has not shown a federal deadline in the alert text reviewed for this story, and Fortinet's advisory or NVD should settle the severity score.

Patch queues are already heavy. Microsoft's October Patch Tuesday fixed a record 1,413 CVEs, as [USA 24 reported](https://usa-24.com/microsoft-patch-tuesday-record-1413-cves/), so security teams have less room than usual to triage a Fortinet fix. Expect more edge-device entries in the KEV catalog, and expect attackers to keep chasing the admin access that makes those devices useful to them.

## Frequently asked questions

### Is CVE-2025-61624 already patched?

Yes. Fortinet patched the flaw in April 2026, and the first fixed releases listed are FortiOS 7.4.10 and 7.6.5. Check Fortinet's advisory for FortiProxy, FortiPAM and other affected builds. Patching does not remove an implant that is already on a device, so check for signs of compromise as well.

### What is PEERSTITCH malware?

PEERSTITCH is a memory-resident malware for ARM64 systems that Unit 42 says runs inside FortiGate's logging and VPN daemons. According to a summary of that research, it leaves no disk artifacts, listening ports or outbound connections. The sources reviewed do not name the threat actor behind it.

### How do I know if my FortiGate firewall has been hacked?

Look for administrator accounts you did not create, changed admin passwords, unfamiliar VPN sessions and API keys you do not recognize. The FBI and Secret Service said in an October 6 advisory that attackers create new admin accounts to lock owners out. Because PEERSTITCH may evade file scans, review configuration and logs as well.

### Is CVE-2025-61624 part of the FortiBleed campaign?

The sources reviewed do not confirm that link. FortiBleed is a credential-driven campaign that the FBI and Secret Service flagged on October 6, and SOCRadar's count cited by the agencies reports more than 86,644 compromised FortiGate devices across 194 countries. Both threats call for similar checks on admin access, credentials and configuration.

## Sources

1. [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog)
2. [PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions, The Hacker News](https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html)
3. [Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant, Palo Alto Networks Unit 42](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)
4. [CVE-2025-61624 Overview, Insights & Trends, Intruder CVEMon](https://cvemon.intruder.io/cves/CVE-2025-61624)
5. [Multiple Vulnerabilities in Fortinet Products Could Allow for Arbitrary Code Execution, CIS Security Advisory](https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-035)
6. [Fortinet RCE vulnerabilities – Critical flaws in FortiSandbox, Greenbone](https://www.greenbone.net/en/blog/fortinet-rce-vulnerabilities-2026-critical-vulnerabilities-in-fortisandbox/)
7. [Known vulnerabilities in Fortinet FortiOS 7.0.16, cybersecurity-help.cz](https://www.cybersecurity-help.cz/vdb/soft/fortinet/fortios/7.0.16/)
8. [CVE-2025-61624: Fortios Path Traversal, Strix](https://www.strix.ai/cve/CVE-2025-61624)
9. [Vulnerability record for CVE-2025-61624 (published April 14, 2026), Vulners database (THN mirror)](https://vulners.com/thn/THN:6D627888E0C0F5109239697449EE0AF6)
10. [FBI warns that FortiBleed credential-harvesting attacks are locking out firewall users, Cybersecurity Dive](https://www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/)
11. [FBI and Secret Service Warn of FortiBleed Lockout Threat, Infosecurity Magazine](https://www.infosecurity-magazine.com/news/fbi-secret-service-fortibleed/)
12. [Fortinet sounds the alarm over actively exploited FortiMail zero-day, The Register](https://www.theregister.com/security/2026/10/02/fortinet-sounds-the-alarm-over-actively-exploited-fortimail-zero-day/5300803)