PEERSTITCH FortiGate implant: CVE-2025-61624 and a 25-month telecom breach

The firewall is supposed to be the thing that watches everything else. Palo Alto Networks' Unit 42 has now published the anatomy of an intrusion where the firewall was the thing nobody watched: a memory-resident implant called PEERSTITCH that lived inside FortiOS processes on a telecommunications provider's appliances from September 2024 until disclosure on October 14, 2026 — roughly 25 months — leaving no file on disk, opening no port, and never dialing out on its own. On October 16 CISA added the path-traversal bug used to plant it, CVE-2025-61624, to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of today, October 19.

Developing story — first published 13:23 CEST (11:23 UTC), October 19, 2026. Updated as the vendor and CISA publish more.

At a glance

CVE	CVE-2025-61624 (path traversal, CWE-22)
Product / affected versions	FortiOS 6.4 · 7.0 · 7.2 all; 7.4.0–7.4.9; 7.6.0–7.6.4 · FortiProxy 7.0 · 7.2 all; 7.4.0–7.4.11; 7.6.0–7.6.4 · FortiPAM ≤ 1.7.0 · FortiSwitchManager 7.0.0–7.0.6; 7.2.0–7.2.7
Fixed in	FortiOS 7.6.5 · 7.4.10 · FortiProxy 7.6.5 · 7.4.12 · FortiPAM 1.7.1 · FortiSwitchManager 7.2.8 · 7.0.7 (older branches: migrate to a fixed release)
CVSS	6.0 Medium (Fortinet PSIRT, CVSS 3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H); 6.5 Medium (NVD, AV:N)
Exploited in the wild	Yes — Unit 42 attributes it to CL-STA-0954 / UNC5820; FBI/US Secret Service advisory dated 2026-10-06
CISA KEV	Added 2026-10-16; federal due date 2026-10-19 (BOD 26-04, forensic triage required)
Public PoC	None public as of 2026-10-19
Official advisory	Fortinet FG-IR-26-122

What actually happened

The entry point was not CVE-2025-61624. It was CVE-2024-47575 — "FortiJump," the unauthenticated-RCE-via-FGFM flaw in FortiManager that CISA put on KEV back in October 2024 (CVSS 9.8). Through the FMG-Access channel on TCP 541, the actor registered a rogue virtual FortiGate named localhost, then generated and exfiltrated a configuration archive. That archive held the running configs of more than 500 managed FortiGate firewalls: global.db and revinfo.db, a serial-to-public-IP inventory, routing and topology, certificates, private keys, and reversible credential ciphertext that Unit 42 confirms was recoverable by brute force — enough to log in over SSL-VPN as the firewalls themselves.

CVE-2025-61624 came later, to go deep rather than wide. It is a path traversal in the FortiOS CLI system.auto-script engine (CWE-22): an authenticated admin — including super_admin — can read and write files as root via crafted CLI commands. The actor used it to drop PEERSTITCH and an Apache mod_md ACME reverse shell. Note the precondition: this bug needs admin, and admin is exactly what the stolen FortiManager archive handed over. The two CVEs are not independent events; they are a chain.

Why the host cannot tell you the truth

PEERSTITCH is a one-shot process-memory-patching injector. It uses ptrace(PTRACE_SEIZE) to attach to two core daemons — /bin/miglogd (logging) and /bin/iked (IKE/IPsec VPN) — maps a 16 KB RWX buffer, writes a 1,344-byte payload through /proc/<pid>/mem, and NOP-patches validation checks. The two hooks talk to each other by scanning in-process traffic for the markers 8550 and 169.254.0.1 and passing session tags through a ring buffer. It patches the logging daemon and the VPN daemon: the sensor and the door, in the same move.

Then it cleaned up after itself. Per Unit 42, the operators ran killall -9 miglogd and killall -9 syslogd, cleared the crash log with diagnose debug crashlog clear, deleted the rogue admins, VPN groups and auto-script objects they had used, and overwrote the md-acme.conf reverse-shell config with a decoy string. The appliance's own records were the first casualty. Twenty-five months is how long that works when the box auditing the network has been taught to lie about itself.

Remediation

1. Am I affected? On each FortiOS/FortiProxy device run get system status and compare the firmware against the table above; on FortiManager, confirm you are past the October 2024 FortiJump fix. Then hunt the host directly, using Unit 42's indicators: inspect /proc/<pid>/maps of miglogd and iked for an anonymous 16,384-byte rwxp region; check the NOP offsets for 0xAA0003E0; grep config revisions for system.auto-script objects containing ../../; and read diagnose debug crashlog read for Signal 11 crashes in miglogd, iked or syslogd.
2. Patch — exact fixed versions. FortiOS 7.6.5 / 7.4.10; FortiProxy 7.6.5 / 7.4.12; FortiPAM 1.7.1; FortiSwitchManager 7.2.8 / 7.0.7. Branches marked "all versions" above (FortiOS 6.4/7.0/7.2, etc.) have no in-branch fix — migrate to a fixed release. Fortinet also ships a virtual patch (FG-VD-59270) in FMWP db 25.120 for shops that cannot upgrade immediately.
3. Can't patch now? Restrict administrative and FGFM access to trusted management networks only, and keep management interfaces off the public internet — CVE-2025-61624 needs an authenticated admin session, so shrinking who can reach the CLI shrinks the exposure.
4. Hunt for compromise. IOCs from Unit 42: payload-hosting hosts 23.240.77[.]233 and 47.18.167[.]159 (/pM.js on 8085; ACME reverse shell on 8084), rogue-registration IPs 45.32.41[.]202 and 198.199.122[.]22, and files lldprx, pM.js, index.js, index.wasm, ipssem.js under /data2/template/. Watch for sniffer configs targeting TCP 3696–3706, 389 (LDAP) and UDP 1812/1813 (RADIUS), and for SSL-VPN logins from unexpected ASNs.
5. Eradicate + verify — and do not stop at the patch. This is the part most write-ups skip. Patching closes CVE-2025-61624; it does nothing about the config archive already stolen. Every credential, certificate and private key that sat on that FortiManager — and on the 500+ firewalls in the archive — stays valid until you rotate it. Rebuild compromised appliances from clean firmware, then rotate all admin credentials, SSL-VPN secrets, certificates and keys across the managed fleet, and only then confirm clean by re-running the host checks above. A fuller fix runbook for pentest-driven remediation is in our automated penetration testing guide.

What is not known yet

• Scale. Unit 42 documents one telecommunications managed-service provider and 500+ firewalls in the stolen archive. Headlines citing "15,000 FortiGates" are not substantiated by the report we read; treat that number as unverified.
• The FGFM impersonation step. Unit 42 assesses with medium confidence that the actor impersonated FortiManager over FGFM, possibly via CVE-2024-26009 and CVE-2024-26008 — the relevant logs were not captured, so the exact mechanism is unconfirmed.
• Attribution. Unit 42 notes overlap with suspected nation-state activity but does not name a specific government.

Where Zero Hunt stands

An implant that patches the logging daemon, opens no port and never beacons on its own account is the exact scenario behind Zero Hunt's AI Traffic Analysis pillar. Once the host's own records are untrustworthy, the wire is the only honest witness — and this intrusion still touched the wire: the sniffer config pushes to downstream FortiGates, the SSL-VPN logins from staging IPs, the ACME reverse shell reaching out to 23.240.77[.]233:8084. Zero Hunt's deep-learning model runs four inference heads on billions of PCAP sequences locally on the appliance GPU at multi-gigabit line rate, flagging the anomalous session to a never-seen destination while it happens — not in a SIEM digest the implant has already deleted.

Because the real failure here is that patching does not undo the theft, the AI Remediation Advisor carries the follow-through: it ranks by real exploitability (KEV first, this CVE is now listed), hands you the exact fixed build per branch with rollout and rollback notes and the management-ACL compensating control, and — critically — flags the stolen trust material as live until rotated, then re-verifies the fix with the same proof that demonstrated the exposure. That runs as an autonomous AI red team on-premise on private models, with a human in the loop for every action that matters, and every finding signed at write time for the audit trail — on an appliance where, unlike the firewall in this story, nothing can quietly rewrite its own logs.