Table of contents
19
Read this in 30 seconds: CVE-2025-61624 is a path traversal in the FortiOS command line that lets an admin with read-write rights write or delete any file. Palo Alto Networks’ Unit 42 found attackers using it to reach root on FortiGate firewalls and plant a memory-resident implant called PEERSTITCH.
- It is scored Medium and was still used to take root. Fortinet rates CVE-2025-61624 CVSS 3.1 6.0, NVD rates it 6.5, and Unit 42 says the escalation went from FortiOS admin to “root on the underlying firewall operating system.”
- It was step two of a chain that started with a 9.8. The same intrusion began in September 2024 with CVE-2024-47575 against a telecom provider’s FortiManager, before Fortinet published that bug.
- CISA gave agencies three days for CVE-2025-61624. The KEV entry was added October 16, 2026, with an October 19 deadline and the forensic triage flag, two days after Unit 42’s report.
- The date it was first used is missing. Unit 42 does not say when CVE-2025-61624 was exploited, and Fortinet’s advisory is dated April 14, 2026, 185 days before KEV.
- Patching does not end this. Unit 42’s attackers held configuration and credential material for more than 500 managed FortiGates, and the report says that trust material stays valid until it is rotated.
A bug scored 6.0 finished an intrusion that began with a 9.8, and the number that decides your patch queue is the wrong one.
CVE-2025-61624 only works for someone who is already an administrator, which is exactly why scanners rank it low and why it matters here. This article covers what the bug is, how Unit 42 says it fit into the PEERSTITCH chain, why the “500 firewalls” figure is easy to misread, what the timeline leaves unanswered, and what to check on a FortiGate you already patched.
Fortinet published advisory FG-IR-26-122, titled “Path Traversal in CLI”, on April 14, 2026. It says the command line interpreter “may allow a privileged attacker to achieve arbitrary write or delete files” through crafted arguments to existing commands.
The record, checked against Fortinet, NVD and the CISA KEV JSON:
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, with a temporal score of 5.4.AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H. The only difference is the attack vector.Fortinet lists these affected and fixed versions:
| Product | Affected | Fix |
|---|---|---|
| FortiOS 7.6 | 7.6.0 to 7.6.4 | 7.6.5 or later |
| FortiOS 7.4 | 7.4.0 to 7.4.9 | 7.4.10 or later |
| FortiOS 7.2, 7.0, 6.4 | All versions | Migrate to a fixed release |
| FortiProxy 7.6 | 7.6.0 to 7.6.4 | 7.6.5 or later |
| FortiProxy 7.4 | 7.4.0 to 7.4.11 | 7.4.12 or later |
| FortiProxy 7.2, 7.0 | All versions | Migrate to a fixed release |
| FortiPAM 1.7 | 1.7.0 | 1.7.1 or later |
| FortiPAM 1.6 and older | All versions | Migrate to a fixed release |
| FortiSwitchManager 7.2 | 7.2.0 to 7.2.7 | 7.2.8 or later |
| FortiSwitchManager 7.0 | 7.0.0 to 7.0.6 | 7.0.7 or later |
FortiPAM 1.8 is not affected. Fortinet lists a virtual patch named FG-VD-59270.0day in FMWP database update 25.120 and no other workaround.
One more place the bug lives: Siemens ships a FortiGate NGFW inside its RUGGEDCOM APE1808. Siemens advisory SSA-975644 was published March 10, 2026, and its revision of May 12 added CVE-2025-61624, with the fix in NGFW 7.4.10. If you run that device, your patch path goes through Siemens support.
Look at the vector again. PR:H means the attacker needs high privileges first, and Fortinet scores the attack vector as local, since the bug is in the CLI. A scanner that sorts by CVSS pushes it below anything critical.
But the score measures one step in isolation. It cannot see that the attacker who reaches this step has already beaten the harder fight, and that the step takes them out of the FortiOS admin sandbox and onto the operating system underneath. CISA’s own tag says the technical impact is total.
We made the same point in our post on CVE-2026-0322, where “authenticated” meant the attacker already held high privileges and the real question was how they got them. For CVE-2025-61624, Unit 42 answers that question.
Unit 42 published the PEERSTITCH report on October 14, 2026. It tracks the activity as CL-STA-0954, also known as UNC5820, and says parts of the post-exploitation work “overlap with intrusions attributed to suspected nation-state actors.” That is the strongest attribution language in the report.
The victim was a telecommunications managed service provider. The steps, in the report’s order:
fgfmsd service, against the provider’s central appliance. They registered a rogue “localhost” virtual FortiGate and pulled a configuration archive shortly after.system.auto-script feature of the FortiOS CLI. Unit 42 says the auto-script object name is not sanitized, so a name with traversal sequences can place the script body anywhere on the file system, and that let an admin, including a super_admin, read and write files as root.Step 1 has a date we can check. Fortinet published its FortiManager advisory FG-IR-24-423 on October 23, 2024, and CISA listed CVE-2024-47575 the same day. So the intrusion began weeks before the first bug in the chain was public.
We have not analyzed the sample ourselves, so this is Unit 42’s description, not ours.
PEERSTITCH is a 64-bit ARM64 Linux program written in C. It runs from memory and leaves no persistent binary on disk, and the loader deletes its own file after running. It opens no listening ports and makes no outbound connections of its own.
It injects code into two FortiOS daemons: miglogd, which handles logging, and iked, which handles IPsec VPN key exchange. The two hooks pass tags to each other, and for tagged VPN sessions iked takes a path that Unit 42 says bypasses default FortiOS security validations.
The command channel is separate. Unit 42 describes attackers abusing the ACME certificate module (mod_md) of the Apache web server, so that attacker-controlled responses run commands that open an SSH reverse shell. A mode that keeps polling keeps the channel alive.
Unit 42 also says, with medium confidence, that the attackers deliberately degraded logging. That matters for hunting, because the usual place to look is the place they were reducing.
The figure you will see in headlines is “500+ firewalls”. Unit 42’s wording is narrower. The configuration archive taken from FortiManager held running configurations, credentials and trust material for more than 500 managed FortiGates. The report calls that exposure of “configuration and credential material rather than confirmed intrusion” into client networks.
How many firewalls actually received PEERSTITCH? The report says “a select number” and gives no count.
Security Affairs’ summary says Palo Alto researchers reported PEERSTITCH was used to “expose 500+ firewalls.” It does not say whether those devices were implanted, accessed or only had configurations exposed, so it can be read as a larger claim than Unit 42 made. If you are scoping your own response, use Unit 42’s version.
| Date | Event | Source |
|---|---|---|
| Sept 2024 | Attackers exploit CVE-2024-47575 on a provider’s FortiManager | Unit 42 |
| 2024-10-23 | Fortinet publishes FG-IR-24-423; CISA lists CVE-2024-47575 the same day | Fortinet, KEV |
| 2026-03-10 | Siemens SSA-975644 published (V1.0, without CVE-2025-61624) | Siemens |
| 2026-04-14 | Fortinet publishes FG-IR-26-122, discovered internally | Fortinet, NVD |
| 2026-05-12 | Siemens revision 1.1 adds CVE-2025-61624 | Siemens |
| 2026-10-14 | Unit 42 publishes the PEERSTITCH report | Unit 42 |
| 2026-10-16 | CISA adds CVE-2025-61624 to KEV, due October 19 | KEV JSON |
The intervals, computed from those dates:
What the record does not say: when attackers first used CVE-2025-61624. Unit 42 gives no date for that step, and its report does not say whether Fortinet knew of the bug at the time. So we cannot call this a zero-day, and we are not going to.
What the dates do show is an advisory that sat at Medium for six months, then moved to CISA’s list within two days of a public incident report. The Fortinet page we read lists no update date, so we cannot tell when its exploited flag appeared.
CVE-2025-61624 needs an administrator account with at least read-write permissions, plus access to the CLI. On its own, that is a high bar. Your real exposure to CVE-2025-61624 depends on how an attacker could get that account:
Fortinet’s FortiManager advisory lists three workarounds for the first bug: fgfm-deny-unknown enable, local-in policies that allow only known FortiGate addresses on port 541, and a custom CA with fgfm-cert-exclusive enable. Each applies to specific FortiManager releases, so check the advisory before using one.
CISA flagged the KEV entry for forensic triage, and Unit 42 says patching alone does not end this compromise. So the order for CVE-2025-61624 matters.
These checks for CVE-2025-61624 abuse come from Unit 42’s report. Several need access below the normal admin CLI, so plan to involve Fortinet TAC or a forensic provider. That last part is our suggestion, not Unit 42’s.
# Crash logs, the command Unit 42 names: look for signal 11 in miglogd, iked or syslogd
diagnose debug crashlog read
# Auto-script objects: look for names containing ../ sequences
show system auto-scriptBeyond those two commands, Unit 42 lists:
miglogd and iked processes./proc/<pid>/mem between them.killall -9 miglogd, killall -9 syslogd and diagnose debug crashlog clear.FortiGateCloud account name that was never provisioned on the device.md-acme.conf under the Apache config directory, created through a traversal path.| Indicator | Where it came from | Note |
|---|---|---|
| 45.32.41.202 and 198.199.122.22 | Unit 42 (rogue FortiGate registrations) | Both also appear in Fortinet’s October 2024 FortiManager advisory |
| 23.240.77.233 and 47.18.167.159 | Unit 42 (staging) | Single-source |
| TCP 541 (FGFM), 8084 and 8085 | Unit 42 | Check management and attacker-server ports |
lldprx, pM.js, index.js, index.wasm, ipssem.js | Unit 42 (file names) | Hashes are in the report’s Table 3 |
/data2/template/ | Unit 42 (staging directory) |
We did not reproduce hashes here. Use the full values in Unit 42’s table, since a shortened hash is not a usable indicator.
We queried the live KEV JSON. Fortinet has 9 entries added in 2026, and 5 of them carry the forensic triage flag. Path traversal, the class behind CVE-2025-61624, accounts for 14 of the 272 entries added in 2026.
The pairing matters more than the counts. Our post on CVE-2026-104286 covers a CVSS 9.8 Fortinet path traversal in FortiMail that needed no account at all. CVE-2025-61624 is the opposite shape: it needs a privileged account and scored Medium, and it still ended up in an incident report.
Fair warning: this is where we mention our own services.
A penetration test cannot find an implant that lives in a firewall daemon’s memory, and we will not claim otherwise. What testing can do is check the front door in this story: whether FortiManager or the FGFM port is reachable from the internet, whether admin interfaces are exposed, and whether old firewall branches are still in service. Our AI VAPT services cover that, and managed engagements start at $2,500 on the pricing page.
If you think a device was already compromised, that is incident response, which is scoped individually. Our terms say AI output can be incomplete or wrong, so a human reviews anything you would act on. XHack does not store your agent chats and cannot access them.
CVE-2025-61624 is a path traversal (CWE-22) in the FortiOS CLI, and in FortiPAM, FortiProxy and FortiSwitchManager. An authenticated admin with read-write permissions can write or delete arbitrary files through crafted arguments. Fortinet scores it 6.0 and NVD scores it 6.5.
Yes. Fortinet’s advisory says it is known to be exploited, Unit 42 reported attackers using it to gain root on FortiGate firewalls, and CISA added it to KEV on October 16, 2026, with an October 19 deadline and the forensic triage flag.
FortiOS 7.6.0 to 7.6.4, FortiOS 7.4.0 to 7.4.9, and every FortiOS 7.2, 7.0 and 6.4 release, plus matching ranges in FortiProxy, FortiPAM 1.7.0 and older, and FortiSwitchManager. Fixed releases are 7.6.5, 7.4.10, and the versions listed in the table above.
We cannot say. Unit 42’s intrusion began in September 2024, but its report gives no date for the use of CVE-2025-61624 and does not say whether Fortinet knew of the bug then. Fortinet published its advisory on April 14, 2026.
Not by itself, according to Unit 42. The implant runs from memory and the attackers held credentials and certificates for managed devices. Hunt first, upgrade, and rotate admin credentials and trust material if the management platform was ever exposed.
Run diagnose debug crashlog read and look for signal 11 crashes in miglogd, iked or syslogd, and review show system auto-script for names with traversal sequences. The deeper memory checks in Unit 42’s report need access beyond the admin CLI.
CVE-2025-61624 is a Medium-rated bug that mattered because of what came before it. A critical flaw in a management server handed an attacker the admin access this one needed, and this one turned that access into root.
Patch the fixed versions, but start by asking whether your FortiManager was reachable and whether any device in your fleet has gaps in its logs. Then rotate what the management platform held.
Categories
Related articles
