Stolen FortiGate admin passwords are turning into full firewall takeovers. Upgrade FortiOS and change them

Fortinet rated this FortiOS bug medium when it fixed it in April, because an attacker already needs an admin login. Unit 42 has now shown what that login is worth: attackers who stole firewall configs from a FortiManager used the bug to get root on FortiGates and plant malware that lives only in memory.

CISA put it on the exploited list Friday, with the same Monday, October 19 federal deadline as BeyondTrust.

A medium-rated FortiOS bug becomes root on the firewall once someone has an admin password. Attackers had the passwords.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

An old FortiOS bug turned stolen admin logins into root

CVE-2025-61624 is a path traversal flaw in the FortiOS command line that lets a privileged user write or delete files through crafted arguments to existing commands. Fortinet’s advisory FG-IR-26-122, first published April 14, 2026, rates it 6.0 and now marks it as known exploited. It also affects FortiProxy, FortiPAM and FortiSwitchManager.

Unit 42 traced the abuse to an intrusion at a telecom managed service provider. The attackers first exploited the 2024 FortiJump bug in FortiManager and walked away with configs for more than 500 managed FortiGates. They cracked admin and SSL VPN passwords from those configs, then used the system.auto-script name field with ../ sequences to write files as root and load an implant Unit 42 calls PEERSTITCH.

CISA added the CVE to its KEV catalog on October 16, due October 19.

Firewalls with leaked admin passwords are the ones at risk

A FortiOS admin, even a super_admin, normally works inside a restricted shell with no access to the underlying system. This bug removes that wall. PEERSTITCH patches the logging and IKE VPN daemons in memory, opens no ports and leaves no binary on disk, so a reboot-and-scan routine can miss it.

The risk is highest for firewalls whose admin passwords could have leaked: devices managed by a FortiManager that was exposed in 2024, configs shared with an MSP, or admin interfaces reachable from the internet. FortiOS 7.2, 7.0 and 6.4 get no fix and must move to a fixed release.

Upgrade FortiOS and change the admin passwords

• Upgrade FortiOS 7.6 to 7.6.5 or later and 7.4 to 7.4.10 or later. Move devices on 7.2, 7.0 or 6.4 to a fixed branch.
• Upgrade FortiProxy to 7.6.5 or 7.4.12, FortiPAM 1.7 to 1.7.1, and FortiSwitchManager to 7.2.8 or 7.0.7.
• Rotate FortiGate admin and local SSL VPN passwords, starting with any device whose config has ever left your hands.
• Remove admin access from the WAN side and limit it to a management network.

Details

• CVE-2025-61624: path traversal in the CLI (CWE-22), CVSS 3 score 6.0, requires a privileged account. Fortinet FG-IR-26-122, published April 14, 2026; known exploited.
• Affected: FortiOS 7.6.0 to 7.6.4, 7.4.0 to 7.4.9, all 7.2, 7.0 and 6.4; FortiProxy 7.6.0 to 7.6.4 and 7.4.0 to 7.4.11; FortiPAM 1.0 to 1.7.0; FortiSwitchManager 7.2.0 to 7.2.7 and 7.0.0 to 7.0.6.
• KEV: added October 16, 2026; federal due date October 19, 2026.
• Related: initial access in Unit 42’s case came from CVE-2024-47575 (FortiJump) on FortiManager.

Hunt / verify

• Config revisions with system.auto-script objects whose names contain ../, such as ../../../../setup.
• Signal 11 crashes for miglogd, iked or syslogd in diagnose debug crashlog read.
• A changed /tmp/apache2/conf/md-acme.conf and admin logins from addresses outside your management range.

Source: Fortinet FG-IR-26-122; Unit 42: PEERSTITCH; CISA KEV alert, October 16, 2026

Sources

• Fortinet PSIRT: FG-IR-26-122
• Unit 42: Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 16, 2026)
• CVE.org: CVE-2025-61624

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].