Source: The Hacker News
CISA has added CVE-2025-61624 to its Known Exploited Vulnerabilities Catalog after evidence of active exploitation. The flaw is a path traversal vulnerability in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager that lets a privileged attacker write or delete arbitrary files through crafted arguments to existing commands. Fortinet patched it in April 2026, but attackers have since been observed using it as part of a sophisticated intrusion chain.
How PEERSTITCH hides inside legitimate FortiOS processes
Palo Alto Networks Unit 42 discovered the activity while investigating a prolonged intrusion against a telecommunications managed service provider that began with the FortiManager flaw CVE-2024-47575, also known as FortiJump. The attackers exfiltrated configurations, credentials and database files covering more than 500 managed FortiGate firewalls, then used the stolen access to establish unauthorised SSL VPN sessions and deploy a previously unreported implant Unit 42 calls PEERSTITCH. The 64-bit ARM64 executable leaves no persistent binary on disk, opens no listening ports and initiates no outbound connections. Instead it injects itself into two legitimate FortiOS daemons, miglogd and iked, and builds a covert communication bridge between them, tagging VPN sessions so they bypass default FortiOS security validations. In practice, that means an attacker can maintain privileged VPN access while endpoint and network monitoring see nothing unusual.
What European network teams should do
Any organisation running Fortinet infrastructure should confirm that FortiOS, FortiPAM, FortiProxy and FortiSwitchManager are on the April 2026 builds or later, review FortiManager logs for unexplained configuration exports, and audit SSL VPN sessions against expected users and source addresses. Because PEERSTITCH is memory-resident, a clean file system does not mean a clean appliance. Where FortiManager compromise is suspected, rotating certificates, keys and administrator credentials for every enrolled device is essential, since the stolen material gives an attacker the keys to the whole estate. Telecoms, managed service providers and any business with a large FortiGate fleet are the natural targets here, and several are based in Europe.
If you run Fortinet firewalls and want an independent review of your patch level, VPN session hygiene or incident response support, contact Excello Digital at https://excello.digital/contact/. We help European organisations harden network perimeters and respond to sophisticated intrusions with clear, verifiable findings.