News

Stolen FortiGate Configs, Cracked Passwords, Then Root: The FortiOS Bug Behind the PEERSTITCH Implant

Published October 23, 2026 · 6 min read · By the Attack Surface Scan team

In brief

CVE-2025-61624 is a path traversal in the FortiOS command line that lets an attacker who is already a FortiGate administrator write or delete files, which Unit 42 shows is enough to get root. Fortinet fixed it in April 2026. On October 14, Unit 42 described a suspected state-sponsored group that stole the configurations of more than 500 FortiGates from a FortiManager, cracked the admin and VPN passwords inside them, and used this flaw to plant an implant called PEERSTITCH. CISA added the CVE to the Known Exploited Vulnerabilities catalog on October 16. Patching closes the hole, but it does not undo stolen credentials or remove an implant.

What happened

Fortinet published advisory FG-IR-26-122, "Path Traversal in CLI," on April 14, 2026. It covers a flaw (CWE-22) in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager that "may allow a privileged attacker to achieve arbitrary write or delete files via specifically crafted arguments to existing commands." Fortinet rates it medium (CVSS 6.0), because the attacker must already be an administrator, and the advisory now marks it as known exploited.

On October 14, Unit 42 explained how that precondition was met. In an intrusion at a telecommunications managed service provider in September 2024, attackers exploited FortiJump (CVE-2024-47575) on a FortiManager and took the configurations of "more than 500 managed FortiGate firewalls." Unit 42 confirmed the passwords in those files could be recovered "by successfully brute-forcing administrative and SSL/VPN passwords from the exfiltrated configuration files." The attackers logged in with valid credentials, then used CVE-2025-61624 "to escalate from FortiOS administrative access to root." The bug is in the CLI's auto-script engine, which does not sanitize object names, so a name like ../../../../setup writes outside its folder. With root, they installed PEERSTITCH, an implant that hides in FortiOS processes. Unit 42 tracks the group as CL-STA-0954 (also known as UNC5820) and notes overlaps with suspected nation-state intrusions. SecurityWeek reports the group appears to have used the flaw as a zero-day. CISA added the CVE to the KEV catalog on October 16, alongside a BeyondTrust Remote Support flaw.

Why it matters if you run public infrastructure

"Requires admin access" is often read as "low priority," and this attack shows why that is a mistake. Admin passwords are stored in device configurations, configurations end up on management platforms and in backups, and one breached FortiManager handed the attackers credentials for hundreds of firewalls at once. A medium-severity flaw then became the step from a stolen login to an implant on the device that guards the network. Unit 42's warning is the one to take away: trust material on a management platform "remains valid until it is rotated," so patching ends the vulnerability but not the compromise.

What to check this week

Upgrade. FortiOS 7.6.5 or 7.4.10 and later; FortiProxy 7.6.5 or 7.4.12; FortiPAM 1.7.1 (1.8 is not affected); FortiSwitchManager 7.2.8 or 7.0.7. FortiOS 7.2, 7.0 and 6.4 and FortiProxy 7.2 and 7.0 get no fix: migrate to a fixed release. Check with get system status on the CLI.
Rotate credentials if your configurations may have left your hands. If you run FortiManager, especially one that was exposed during the FortiJump attacks, assume the admin and SSL VPN passwords stored in managed configurations are known. Change them, and reissue the certificates and keys those devices hold.
Hunt for PEERSTITCH. Unit 42 suggests looking for system.auto-script objects containing ../../ in configuration revisions, signal 11 crash logs for miglogd, iked or syslogd (diagnose debug crashlog read), and contact with 23.240.77[.]233 or 47.18.167[.]159. Expect anti-forensics: the attackers killed logging daemons and deleted the rogue admins, VPN groups and auto-script objects they created.
Apply the virtual patch if you cannot upgrade yet. Fortinet lists no workaround, but offers a FortiGuard virtual patch (FG-VD-59270.0day).
Keep management interfaces off the internet, and require MFA for every administrator and VPN account, so a cracked password alone is not enough.

How Attack Surface Scan covers this

Attack Surface Scan recognizes the FortiGate SSL VPN sign-in page on hosts under your verified domains, including hosts found through certificate transparency logs. FortiOS does not show its version to anonymous visitors, so it is one of the edge products where we raise a potential match for KEV-listed CVEs like this one, capped at medium severity and tagged potential, with instructions for checking the real version. We cannot see whether credentials were stolen or an implant is present, and we do not log in or send exploit traffic. See Vulnerability matching for the details.

Sources

Know every FortiGate you expose

Attack Surface Scan finds the VPN portals and admin interfaces under your domains, flags known exploited CVEs for the edge products it recognizes, and alerts when a new one appears. 7-day trial, no card required.

Start your 7-day trial