AllTech
On this page
Field notes from the engineering team
On October 16, 2026, CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog. It is a path traversal flaw in the command line of FortiOS, the operating system on Fortinet FortiGate firewalls. Fortinet rates it medium, because the attacker has to be logged in as an administrator first.
That rating understates how it was used. Palo Alto Networks’ Unit 42 published a report on October 14 describing an intrusion where attackers used this flaw to go from administrator access to a memory-only implant on the firewall. The flaw does not get anyone in from the internet. It helps an attacker who already has admin credentials stay on the device.
If your firewall is a Fortinet product, or a vendor manages one for you, read the version table below and ask which release you are on.
The short version
| Item | Detail |
|---|---|
| CVE | CVE-2025-61624 (Fortinet advisory FG-IR-26-122) |
| Severity | Medium, CVSS v3.1 6.0 (Fortinet’s rating). Attack type: authenticated. |
| What it is | Path traversal in the command line interpreter. A privileged attacker can write or delete arbitrary files on the device through specially crafted arguments to existing commands. |
| Who can use it | An administrator with a read-write profile or higher. |
| Affected | FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. Versions are in the table below. |
| Fix | FortiOS 7.6.5 or 7.4.10. No fixed release on FortiOS 7.2, 7.0 or 6.4: migrate. |
| Workaround | A virtual patch, FG-VD-59270.0day, in FortiGuard FMWP database update 25.120. |
| Exploitation | Fortinet marks it as known exploited. CISA added it to the KEV catalog on October 16, 2026. |
Which versions are affected
Fortinet published the advisory on April 14, 2026. The fixed versions are:
| Product | Affected | Fixed |
|---|---|---|
| FortiOS 7.6 | 7.6.0 to 7.6.4 | 7.6.5 |
| FortiOS 7.4 | 7.4.0 to 7.4.9 | 7.4.10 |
| FortiOS 7.2, 7.0, 6.4 | All versions | Migrate to a fixed release |
| FortiProxy 7.6 | 7.6.0 to 7.6.4 | 7.6.5 |
| FortiProxy 7.4 | 7.4.0 to 7.4.11 | 7.4.12 |
| FortiProxy 7.2, 7.0 | All versions | Migrate to a fixed release |
| FortiPAM 1.7 | 1.7.0 | 1.7.1 (1.8 is not affected) |
| FortiPAM 1.0 to 1.6 | All versions | Migrate to a fixed release |
| FortiSwitchManager 7.2 | 7.2.0 to 7.2.7 | 7.2.8 |
| FortiSwitchManager 7.0 | 7.0.0 to 7.0.6 | 7.0.7 |
Fortinet’s guidance for the branches with no fix is to migrate. If a firewall is on FortiOS 7.2, 7.0 or 6.4, that is a planned project, not a patch window.
How attackers used it
Unit 42 investigated an intrusion at a telecommunications managed service provider that it dates to September 2024. The attackers, tracked as CL-STA-0954 (also known as UNC5820), got in through CVE-2024-47575, a flaw in FortiManager, the central console for managing FortiGate firewalls.
From that one appliance they took an archive holding running configurations, cryptographic material, and database files for more than 500 managed FortiGate firewalls. Those firewalls protected the provider’s own network and its clients’ networks. With that material, Unit 42 says the attackers kept long-term access, intercepted network traffic, set up VPN sessions, and deployed backdoors.
CVE-2025-61624 came in at the next step. The attackers pushed script objects with names like ../../../../setup to a number of firewalls. The path traversal let those objects write files outside the intended location, and that is how they deployed PEERSTITCH, a memory-resident implant for the firewall. Per Unit 42, it leaves no binary on disk, opens no listening ports, and starts no outbound connections of its own. It patches two core FortiOS processes, the logging daemon and the IPsec VPN daemon, and uses them to talk to each other.
Unit 42 examined only the provider’s environment, not its clients’ networks, so what is confirmed is the theft of configuration and credential material, not intrusions into those clients. The report describes one intrusion by one group, not mass exploitation.
Why a medium rating still deserves attention
Firewall admin credentials rarely stay in one place. They sit in configuration files, backups, and management consoles. In this case, one compromised console exposed that material for hundreds of firewalls at once. A flaw that needs admin rights is a small worry when the credentials are tightly held, and a large one when they have already leaked.
A memory-only implant also changes what a check can tell you. A clean configuration does not prove a clean firewall. Unit 42 says finding PEERSTITCH takes specialized hunting techniques.
What to do
1. Find out what you run. Ask your IT provider: “Do we have any Fortinet firewalls, FortiProxy, FortiPAM, FortiSwitchManager or FortiManager, and which versions?” Compare the answer against the table above.
2. Upgrade or plan the migration. Move to FortiOS 7.6.5 or 7.4.10 or later, or the fixed release for the other products. Put any device on FortiOS 7.2, 7.0 or 6.4 on a migration schedule.
3. Use the virtual patch if you cannot upgrade yet. Fortinet lists virtual patch FG-VD-59270.0day, delivered in FortiGuard FMWP database update 25.120, for devices that cannot be upgraded right away. It is a stopgap, not a replacement for the upgrade.
4. Patch FortiManager too. The intrusion in Unit 42’s report began with CVE-2024-47575 on FortiManager. If you run one, confirm it is on a release that fixes that flaw.
5. Rotate credentials that may have left. Our advice: if a management console or a configuration backup may have been exposed, change firewall admin and VPN passwords and replace certificates and keys. Patching does not take back credentials an attacker already holds.
6. Limit who can log in as an administrator. Our advice: keep firewall management off the public internet, require multifactor authentication on VPN and admin logins, and remove admin accounts nobody can explain.
7. Review the firewall for traces. Check the configuration for administrator accounts you do not recognize and for auto-script entries with path characters such as ../ in their names. A clean result is weak evidence, because an implant that lives only in memory leaves nothing in the configuration. If anything looks wrong, treat the firewall as compromised and involve Fortinet support or an incident response team for a deeper check.
How we help
Keeping a firewall patched and its management locked down is routine work in our firewall and routing service, and remote monitoring and patching keeps track of what version every device is running. Alerts from a firewall that is behaving oddly, such as unfamiliar admin logins or configuration changes, are what our managed SOC reviews. If a firewall may be compromised, incident response covers isolating it, preserving evidence, and resetting credentials.
Many organizations still leave a VPN login or an admin page open to the internet. Zero trust access replaces that with access tied to identity and device, so a stolen password alone is worth less.
For law firms and municipalities, a firewall configuration holds the map of the internal network and the keys to remote access. If you are not sure what firewall you run or who can administer it, ask us and we will help you find out.
We covered another exploited flaw in remote access tools this week in BeyondTrust Remote Support Zero-Day: What to Check.
