PEERSTITCH: What Fortinet Users Should Do

Fortinet users should verify fixes for CVE-2025-61624 and investigate earlier management-plane exposure, not treat patching as proof of a clean appliance. Unit 42 links the flaw to PEERSTITCH, a memory-resident implant (Unit 42 research). Review centralized management access, preserve relevant evidence, and rotate exposed credentials and trust material when compromise is established.

On October 16, 2026, The Hacker News reported that the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-61624 to its Known Exploited Vulnerabilities (KEV) catalog (The Hacker News). This Common Vulnerabilities and Exposures (CVE) identifier affects FortiOS and other Fortinet products; Fortinet initially published its patch advisory on April 14, 2026 (Fortinet advisory FG-IR-26-122). The immediate task is to verify remediation and determine whether management access was abused.

What are the key takeaways?

• Fortinet says exploitation requires a privileged attacker; this is not, by itself, an unauthenticated internet-to-root flaw (Fortinet advisory FG-IR-26-122).
• Unit 42 observed a separate FortiManager initial-access flaw followed by credential theft and FortiOS privilege escalation (Unit 42 research).
• PEERSTITCH modifies running processes and leaves no persistent binary, making a file-only review insufficient (Unit 42 research).
• Unit 42 documented exposure of customer firewall configurations, not confirmed intrusion into those customers’ networks (Unit 42 research).

What changed this week?

New research and the reported KEV addition put an already-patched vulnerability back on the response agenda. Unit 42 published its PEERSTITCH analysis on October 14, and The Hacker News reported the October 16 catalog addition with an October 19 remediation deadline for federal agencies (Unit 42 research) (The Hacker News).

The investigated intrusion began in September 2024, not this week (Unit 42 research). Do not confuse a current disclosure with a newly started attack, or assume the reported federal deadline is a universal legal deadline for private companies.

How did attackers reach the firewalls?

Unit 42 traced initial access to CVE-2024-47575 on a centralized FortiManager appliance, followed by theft of configurations, credentials, and cryptographic material (Unit 42 research). Attackers later exploited CVE-2025-61624 to move from FortiOS administrative access to root-level control (Unit 42 research).

The distinction matters: Fortinet describes CVE-2025-61624 as path traversal in the command-line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, enabling a privileged attacker to write or delete files (Fortinet advisory FG-IR-26-122). The PEERSTITCH investigation concerns FortiGate devices; it does not establish deployment of that implant across every affected product.

Which FortiOS versions should you check?

Compare the installed release against Fortinet’s fixed-version table and follow the supported upgrade path (Fortinet advisory FG-IR-26-122). Retain evidence that installation completed.

FortiPAM, FortiProxy, and FortiSwitchManager have separate version rows in the advisory (Fortinet advisory FG-IR-26-122). Inventory those products too and assign remediation owners.

What should your team do this week?

Separate the update task from the investigation task. We recommend the following sequence, with vendor support and incident responders coordinating actions that could interrupt firewall services.

1. Verify updates. Check the installed release on every affected appliance against the applicable vendor row, including devices administered by a provider (Fortinet advisory FG-IR-26-122).
2. Map management relationships. Identify the central managers, enrolled firewalls, administrative accounts, and owners. Unit 42’s case shows how stolen management material can expose downstream devices (Unit 42 research).
3. Preserve before disruptive recovery. If compromise is suspected, coordinate collection before rebooting or rebuilding. This is our evidence-preservation recommendation because Unit 42 identifies volatile process memory as a detection surface (Unit 42 research).
4. Investigate access and configuration changes. Review unauthorized administrator accounts, virtual private network (VPN) sessions, auto-script objects, and logging interruptions documented in the research (Unit 42 research). Reconcile findings against approved operational work.
5. Address exposed trust material. Unit 42 warns that stolen management credentials and certificates remain useful after the platform is patched until they are rotated (Unit 42 research). Plan replacement with the owners of each affected management relationship.

Define responsibilities through our managed firewall service. See also BeyondTrust patching versus investigation; its product-specific recovery instructions do not apply to Fortinet.

What evidence can help detect PEERSTITCH?

Unit 42 recommends specialized memory and configuration hunting, rather than relying only on files or open ports (Unit 42 research). Its detection table covers unusual executable memory regions in the miglogd logging process and iked VPN process, process integrity, crash records, and suspicious auto-script revisions (Unit 42 research).

Give the original research to a qualified responder instead of improvising process-memory inspection on a production firewall. Missing records are an investigation limitation, not proof of safety: the researchers observed log clearing and telemetry disruption (Unit 42 research).

What would our SOC ask your provider?

Our U.S.-based security operations center (SOC) would request separate evidence for patch completion, exposure review, and credential remediation. We would ask who can preserve appliance evidence, who approves service interruption, and which customer-facing management relationships require review.

This is our proposed operating approach, not a customer incident. Use the managed SOC pricing guide to clarify which investigation and coordination responsibilities are included in your service.

What else should administrators know?

Does CVE-2025-61624 require prior privileges?

Yes. Fortinet says exploitation requires a privileged attacker; Unit 42 observed its use after attackers obtained administrative access (Fortinet advisory FG-IR-26-122) (Unit 42 research).

Does a current patch prove PEERSTITCH was never present?

No. The research describes memory-resident malware and stolen trust material that requires separate remediation (Unit 42 research). We recommend reviewing prior exposure independently of current patch status.

Were all downstream customer networks breached?

That is not established. Unit 42 investigated the provider’s environment and explicitly distinguishes configuration and credential exposure from confirmed intrusion into client networks (Unit 42 research).

Where should responders get detection details?

Use Unit 42’s original detection table and indicators, alongside Fortinet’s advisory for version remediation (Unit 42 research) (Fortinet advisory FG-IR-26-122). Coordinate appliance-level collection with qualified responders and vendor support.

Need help verifying remediation?

Bring your appliance inventory, update plan, and response questions to a focused review. Schedule a security review or Call 833-92-CYBER to clarify remediation and investigation responsibilities.