Call: Patch now
FortiOS CVE-2025-61624: an April fix, an October KEV entry, and an implant called PEERSTITCH
- Vendor
- Fortinet
- Products
- FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager
- Date
- Status
- Open
Call: Patch now. The fix shipped in April. CISA added the bug to KEV on Oct 16 after Unit 42 tied it to PEERSTITCH, an in-memory FortiGate implant that hooks miglogd and iked to wave tagged VPN sessions through.
Affected: FortiOS 7.6.0-7.6.4 and 7.4.0-7.4.9, plus every release of 7.2, 7.0 and 6.4. Those three trains have no fix in their own branch, so you’ll need to migrate to a fixed train. FortiProxy, FortiPAM and FortiSwitchManager are also affected.
Fixed in: FortiOS 7.6.5+ / 7.4.10+, FortiProxy 7.6.5+ / 7.4.12+, FortiPAM 1.7.1+, FortiSwitchManager 7.2.8+ / 7.0.7+.
Context: Exploitation needs admin access. In the Unit 42 case, the attackers got that by compromising FortiManager (FortiJump) and stealing configs and credentials. Patch, rotate admin and VPN credentials, and check how exposed your FortiManager is. Fortinet also offers virtual patch FG-VD-59270.0day.
Sources: FortiGuard FG-IR-26-122, The Hacker News, SecurityWeek.