[Urgent] Fortinet FortiOS, FortiProxy and More CVE-2025-61624: Update to 7.6.5 / 7.4.10+ (CVSS v3.1 6.5) — Used to Go from Admin to Root and Plant In-Memory Malware

The command line (CLI) of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager has a flaw that lets an attacker with admin rights write or delete arbitrary files on the device. It is CVE-2025-61624. Fortinet published its advisory (FG-IR-26-122) on 14 April 2026, and CISA added it to KEV (its catalog of known exploited vulnerabilities) on 16 October, citing evidence of exploitation. On 14 October, Palo Alto Networks' Unit 42 also reported a real intrusion in which it was used.

If you run these products yourself, check whether your version is affected and update to a fixed release. FortiOS 7.6 needs 7.6.5 or later and 7.4 needs 7.4.10 or later. FortiOS 7.2, 7.0 and 6.4 are affected in every version, and Fortinet tells you to migrate to a release line that has a fix.

"Needs admin rights" does not mean "minor". Unit 42 reports that the attackers used this flaw to escalate from a FortiOS administrator to root on the device's operating system, and planted a new ARM64 malware called PEERSTITCH that lives only in memory. Besides updating, you need to check whether you were already compromised.

Where this score comes from. 6.5 is the CVSS v3.1 value assigned by NVD (NIST), with the vector `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H` (network, high privileges required, no user interaction). Fortinet, the CNA, rates the same v3.1 as 6.0 (MEDIUM); the only difference in its vector is `AV:L` (local). Fortinet's advisory also shows a separate temporal score of 5.4. Both are MEDIUM, and NVD has no v4.0 value. This article uses NIST's value in the box and shows Fortinet's beside it. A medium score has still been used to take root in a real intrusion, so do not lower the priority on the number alone. The weakness type is CWE-22 (path traversal).

What to do now

• ✓Check whether your devices are affected. Compare the FortiOS, FortiPAM, FortiProxy and FortiSwitchManager versions with the list below. FortiPAM 1.8 is not affected. Fortinet NGFW built into Siemens products can be affected too (see "Affected versions and fixes")
• ✓Update to a fixed release. FortiOS 7.6.0–7.6.4 → 7.6.5 or later; 7.4.0–7.4.9 → 7.4.10 or later. FortiProxy 7.6.0–7.6.4 → 7.6.5 or later; 7.4.0–7.4.11 → 7.4.12 or later. FortiPAM 1.7.0 → 1.7.1 or later. FortiSwitchManager 7.2.0–7.2.7 → 7.2.8 or later; 7.0.0–7.0.6 → 7.0.7 or later
• ✓FortiOS 7.2, 7.0 and 6.4, FortiPAM 1.6 and earlier, and FortiProxy 7.2 and 7.0: migrate to a release line that has a fix. Fortinet lists every version of these as affected and says "migrate to a fixed release". Fortinet's Upgrade Path Tool shows the route
• ✓If you cannot update right away, look at the virtual patch Fortinet points to. The advisory says a virtual patch named "FG-VD-59270.0day" is available in FMWP database update 25.120. It is offered as a stopgap, not a substitute for updating
• ✓Check for compromise 1: look in the configuration history for `system.auto-script` objects whose names contain `../../`. According to Unit 42, the attack uses such names to place files outside the intended directory. The examples Unit 42 saw were `../../../../setup` and `../../tmp/apache2/conf/md-acme.conf`. The attackers deleted these objects and rogue admin accounts right after running them, so check the configuration revisions, not just the current configuration
• ✓Check for compromise 2: read the crash log. Unit 42 advises running `diagnose debug crashlog read` and looking for signal 11 (segmentation fault) crashes of `miglogd`, `iked` or `syslogd`, which can be left behind by failed memory-injection attempts
• ✓Check for compromise 3: look for network and file traces. Compare against the addresses, file names and hash in "Indicators of compromise published by Unit 42" below. Not finding them does not prove you are clean, because the attackers are reported to have removed their traces
• ✓Leave memory inspection to specialists. PEERSTITCH leaves nothing on disk, so Unit 42 also describes how to inspect the memory of `miglogd` and `iked` (for example, looking for an anonymous 16,384-byte executable region). That takes forensic expertise. If you suspect a compromise on a device whose management interface was reachable from the internet, contact Fortinet support or an incident-response firm
• ✓Review your admin accounts. The attack presupposes an admin with at least read-write permissions. Look for unused admins, shared admins and reused passwords. This is general hygiene drawn from the attack's precondition, not a step Fortinet prescribes

Affected versions and fixes (from Fortinet's advisory)

• ▸FortiOS: 7.6.0–7.6.4 → 7.6.5 or later; 7.4.0–7.4.9 → 7.4.10 or later; 7.2, 7.0 and 6.4: all versions affected (migrate to a fixed release)
• ▸FortiProxy: 7.6.0–7.6.4 → 7.6.5 or later; 7.4.0–7.4.11 → 7.4.12 or later; 7.2 and 7.0: all versions affected (migrate to a fixed release)
• ▸FortiPAM: 1.8 is not affected; 1.7.0 → 1.7.1 or later; 1.6, 1.5, 1.4, 1.3, 1.2, 1.1 and 1.0: all versions affected (migrate to a fixed release)
• ▸FortiSwitchManager: 7.2.0–7.2.7 → 7.2.8 or later; 7.0.0–7.0.6 → 7.0.7 or later
• ▸Siemens RUGGEDCOM APE1808 (with Fortinet NGFW): all versions with Fortinet NGFW earlier than 7.4.10 are affected. Siemens says to update Fortigate NGFW to 7.4.10 or later and to contact customer support for the patch and update information (Siemens ProductCERT SSA-975644). This product is in the CVE record at NVD but not in Fortinet's own product table

What the flaw does

• ▸Where and what: passing specially crafted arguments to existing CLI commands can let an attacker write or delete arbitrary files on the device (CWE-22)
• ▸Privileges needed: NVD describes "an authenticated attacker with admin profile and at least read-write permissions". CVSS is `PR:H` (high privileges). This is not a flaw anyone can trigger without logging in
• ▸How it works, according to Unit 42: a FortiOS administrator works inside a restricted CLI with no shell and no direct control of the file system or processes. But the name of a `system.auto-script` object is not sanitized, so a name containing `../` can put the script body anywhere on the file system. The script runs with the privileges of the auto-script engine (root), so an admin account can gain root
• ▸Fortinet's classification: the advisory lists the impact as escalation of privilege, severity as Medium, discovery as Internal, and "Known Exploited" as Yes
• ▸CISA's view: its 16 October alert says it added the entry on evidence of active exploitation. CISA's assessment recorded in NVD (SSVC) is exploitation "active", automatable "no", technical impact "total". Ransomware use is "Unknown" in the KEV field

The intrusion Unit 42 reported

This section follows Unit 42's report "Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant", published on 14 October 2026. It describes one intrusion at a managed-service provider serving telecom customers. Exploitation of this flaw may not be limited to that case, and the public sources do not show how many other cases exist.

• ▸When and by whom: the intrusion is said to have happened in September 2024. Unit 42 tracks the attacker as "CL-STA-0954 (aka UNC5820)" and says parts of the activity overlap with intrusions attributed to suspected nation-state actors. That is not a firm attribution
• ▸The way in was a different flaw: initial access came through CVE-2024-47575 in FortiManager, the central management platform. CVE-2025-61624, the subject of this article, was used afterwards to escalate from FortiOS admin to root. The FortiManager flaw is outside the scope of this article
• ▸PEERSTITCH: Unit 42 describes a new memory-resident ARM64 malware. It leaves no file on disk, opens no listening port and starts no outbound connection of its own; it communicates through traffic from legitimate processes on the device, so it can slip past ordinary endpoint and network detection. It injects into two processes, `miglogd` (logging) and `iked` (IPsec VPN)
• ▸A second foothold: the report says the attackers abused the device's built-in Apache `mod_md` (certificate automation) to create a path for running remote commands
• ▸Clean-up: rogue admin accounts, VPN groups and auto-script objects were deleted by configuration rollback right after execution, and log delivery was disrupted. That is why the configuration history and the crash log matter
• ▸How far it spread: from the FortiManager, the attackers took configurations, cryptographic keys and credentials for more than 500 managed FortiGate firewalls. The report adds that it did not examine the customers' networks and confirmed no intrusion into them

Indicators of compromise published by Unit 42

These are the easiest-to-check indicators from the report. (`[.]` is the dot written in brackets so nobody visits the address by accident.) The full list and a YARA detection rule are in Unit 42's report.

• ▸IP addresses: `23.240.77[.]233` (hosted the attack files and a rogue certificate authority), `47.18.167[.]159` (also hosted files), `45.32.41[.]202` and `198.199.122[.]22` (fake FortiGate devices added to the FortiManager)
• ▸Auto-script object names (path traversal): `../../../../setup`, `../../tmp/apache2/conf/md-acme.conf`
• ▸File names: `lldprx` (the PEERSTITCH core), `pM.js`, `index.js`, `index.wasm`, `ipssem.js`
• ▸SHA-256 of the core binary: `b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70` (the PEERSTITCH injector; see the report for the other hashes)
• ▸Not finding these does not prove you are clean. The files delete themselves after running and the implant lives in memory, so file names and hashes may not turn up

Timeline

• ▸September 2024: the period in which the intrusion Unit 42 investigated is said to have happened (Unit 42)
• ▸14 April 2026: Fortinet published advisory FG-IR-26-122. NVD also recorded CVE-2025-61624 that day
• ▸14 October: Unit 42 published its PEERSTITCH report describing the exploitation of this flaw
• ▸15 October: the date of the CISA assessment (SSVC) recorded in NVD
• ▸16 October: CISA added it to KEV. The federal due date recorded in NVD is 19 October, which has passed. It applies to US federal agencies and does not bind organisations in Japan, but it shows how urgent CISA considers it
• ▸17 October: NVD's record was last modified

What I could not confirm

• ▸How widely this flaw is exploited beyond Unit 42's report. Neither CISA nor Fortinet describes the scale of attacks or damage
• ▸Why there is a gap between the September 2024 intrusion and the April 2026 disclosure. Unit 42 says the flaw was exploited in the 2024 intrusion, but I did not confirm whether a fix or disclosure existed at that time
• ▸When Fortinet set "Known Exploited" to Yes. The advisory's timeline shows only the initial publication on 14 April
• ▸Advisories from Japanese public bodies. I did not check JVN or other domestic sources for this one
• ▸Release dates of the fixed versions. The advisory names the fixed versions, but I did not confirm when each was released. Check Fortinet's support site for downloads
• ▸Whether PEERSTITCH targets only ARM64 devices. The report describes an ARM64 binary; the public sources do not say whether the same technique works on other hardware

Three lines to share

• ▸A flaw in the CLI of Fortinet products (FortiOS, FortiProxy, FortiPAM, FortiSwitchManager), CVE-2025-61624, CVSS v3.1 6.5. Unit 42 reported on 14 October that it was used to go from admin to root and plant in-memory malware, and CISA added it to KEV on 16 October
• ▸★Update FortiOS to 7.6.5 / 7.4.10 or later. 7.2, 7.0 and 6.4 are affected in every version and need a move to a fixed line. If you cannot update, check Fortinet's virtual patch (FG-VD-59270.0day)
• ▸Do not stop at updating. Check the configuration history for `system.auto-script` objects containing `../../`, and the crash log for abnormal exits of `miglogd` and `iked`; if anything looks wrong, contact Fortinet or a specialist firm