DaystoPatch

FortinetExploited incident

FortiOS CLI path traversal used to escalate admin access to root (PEERSTITCH)

CVE-2025-61624Medium, CVSS 6.0In CISA's Known Exploited Vulnerabilities catalog since 16 Oct 2026

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statementUnverified source
Exposure
same day
First public report to first fixUnverified source
Follow-through
same day
First public report to a fix for every supported versionUnverified source
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date onlyUnverified: no archived copy, quote not checked yet

    Fortinet PSIRT FG-IR-26-122CuratedQuote not checked yet

    2026-04-14: Initial publication

    Discovered internally. The earliest Wayback snapshot (20260415005955) already shows 'Known Exploited: Yes', so the vendor's advisory is the first public signal that the bug existed and was exploited.

    Source
    Fortinet PSIRT FG-IR-26-122 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CVE.org record CVE-2025-61624ClaimedQuote verified14 Apr 2026, 15:39 UTC

    An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a7cc50d645492ac2…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet15 Apr 2026, 04:10 UTC

    Fortinet、悪用確認の脆弱性含む複数製品の脆弱性について注意喚起（CVE-2025-61624ほか） | Codebook｜Security News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/45283/

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks Unit 42 blog (PEERSTITCH)CuratedQuote verified14 Oct 2026

    The attackers exploited another vulnerability, CVE-2025-61624, via FortiOS auto-script path traversal. This exploit facilitated the deployment of PEERSTITCH, a novel, memory-resident ARM64 malware.

    Page byline: 'Published: October 14, 2026'. First detailed public exploitation report; later than the vendor advisory.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:37eb29ba9f9a54c8…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet14 Oct 2026, 22:37 UTC

    PEERSTITCH patches FortiGate daemons in memory - no file, no port, and patching alone won't evict it. 9 detections, 28 IOCs. Full analysis + IOCs: https:// intel.threadlinqs.com/threat/T L-2026-3558

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-61624)ClaimedQuote verified16 Oct 2026

    Fortinet Multiple Products Path Traversal Vulnerability

    Added to CISA's KEV catalog on 2026-10-16.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame dayUnverified: no archived copy, quote not checked yet

    Fortinet PSIRT FG-IR-26-122CuratedQuote not checked yet

    2026-04-14: Initial publication

    Source
    Fortinet PSIRT FG-IR-26-122 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    date onlysame day

    Fortinet PSIRT FG-IR-26-122 (Wayback snapshot 2026-04-15 00:59 UTC)CuratedQuote verified

    Virtual Patch named "FG-VD-59270.0day." is available in FMWP db update 25.120

    Virtual patch listed in the initial advisory (published 2026-04-14 per its timeline); snapshot taken the next day UTC.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:871a293372ce5f85…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date onlysame day

    Fortinet PSIRT FG-IR-26-060 (Wayback snapshot 2026-01-27 22:53 UTC; shows FortiOS 7.6.5 already released)CuratedQuote verified

    FortiOS 7.6 7.6.0 through 7.6.5

    R2: FortiOS 7.6.5 (a listed fix for CVE-2025-61624) appears as an existing, affected release in this unrelated advisory published 2026-01-27, so it was downloadable by then, eleven weeks before FG-IR-26-122. Upper bound: it may have shipped earlier (FG-IR-25-647 of 2025-12-09 still lists '7.6.0 through 7.6.3', so 7.6.5 shipped between 2025-12-09 and 2026-01-27). FortiOS 7.4.10 ('7.4.0 through 7.4.10') is shown in the same capture.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:15b36de12a8c363b…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet PSIRT FG-IR-26-122 (Wayback snapshot 2026-04-15 00:59 UTC)CuratedQuote verified14 Apr 2026

    Upgrade to 7.6.5 or above

    Fixed versions (FortiOS 7.6.5 / 7.4.10, FortiPAM 1.7.1, FortiProxy 7.6.5 / 7.4.12, FortiSwitchManager 7.2.8 / 7.0.7) were listed in the initial advisory dated 2026-04-14. The fixed builds may have shipped before the advisory (silent fix); not evidenced, so the advisory date is used. Superseded as earliest by the FG-IR-26-060 evidence (R2).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:871a293372ce5f85…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Fortinet PSIRT FG-IR-26-122 (Wayback snapshot 2026-04-15 00:59 UTC)CuratedQuote verified

    Upgrade to 7.0.7 or above

    Every branch with a fixed version had one in the initial advisory. FortiOS 7.2/7.0/6.4, FortiPAM 1.0-1.6 and FortiProxy 7.2/7.0 get no fix ('Migrate to a fixed release') and are not counted.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:871a293372ce5f85…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. FG-IR-26-060

    Changed without a revision note

    Administrative FortiCloud SSO authentication bypass

    Version table: 2 rows added and 1 row removed. One new row reads "FortiNAC-F 7.6 | 7.6.3 through 7.6.5 | Upgrade to 7.6.6 or above".

    • Fixed versions
    Version table rows
    BeforeFortiSwitchManager 7.0 | 7.0.0 through 7.0.7 | Upgrade to upcoming 7.0.8 or above
    AfterFortiNAC-F 7.6 | 7.6.3 through 7.6.5 | Upgrade to 7.6.6 or above; FortiSwitchManager 7.0 | 7.0.0 through 7.0.7 | Upgrade to 7.0.8 or above
    Verbatim wording. Removed text is struck through. Added text is bold.
    Before

    or above FortiProxy 7.0 | 7.0.0 through 7.0.22 | Upgrade to 7.0.23 or above FortiSwitchManager 7.2 | 7.2.0 through 7.2.8 | Upgrade to 7.2.9 or above FortiSwitchManager 7.0 | 7.0.0 through 7.0.7 | Upgrade to upcoming 7.0.8 or above FortiWeb 8.0 | 8.0.0 through 8.0.3 | Upgrade to 8.0.4 or above FortiWeb 7.6 | 7.6.0 through 7.6.6 | Upgrade to 7.6.7 or above FortiWeb 7.4 | 7.4.0 through 7.4.11 | Upgr

    After

    11 | Upgrade to 7.2.12 or above FortiManager 7.0 | 7.0.0 through 7.0.15 | Upgrade to 7.0.16 or above FortiManager 6.4 | Not affected | Not Applicable FortiNAC-F 7.6 | 7.6.3 through 7.6.5 | Upgrade to 7.6.6 or above FortiNAC-F 7.4 | Not affected | Not Applicable FortiNAC-F 7.2 | Not affected | Not Applicable FortiOS 8.0 | Not affected | Not Applicable FortiOS 7.6 | 7.6.0 through 7.6.5 | Upgrade to

    Earlier version captured 21 Feb 2026, 11:20 UTC: archived copyLater version captured 9 Jul 2026, 15:43 UTC: archived copyRecovered from archived copiesSnapshots e4573e1a2f… and 9cdc135f0c…Incident page

  2. FG-IR-26-060

    Changed without a revision note

    Administrative FortiCloud SSO authentication bypass

    Version table: 15 rows added and 13 rows removed. One new row reads "FortiAnalyzer 7.2 | 7.2.0 through 7.2.11 | Upgrade to 7.2.12 or above".

    • Fixed versions
    Version table rows
    BeforeFortiAnalyzer 7.2 | 7.2.0 through 7.2.11 | Upgrade to upcoming 7.2.12 or above; FortiAnalyzer 7.0 | 7.0.0 through 7.0.15 | Upgrade to upcoming 7.0.16 or above; FortiManager 7.2 | 7.2.0 through 7.2.11 | Upgrade to upcoming 7.2.12 or above; FortiManager 7.0 | 7.0.0 through 7.0.15 | Upgrade to upcoming
    AfterFortiAnalyzer 7.2 | 7.2.0 through 7.2.11 | Upgrade to 7.2.12 or above; FortiAnalyzer 7.0 | 7.0.0 through 7.0.15 | Upgrade to 7.0.16 or above; FortiManager 7.2 | 7.2.0 through 7.2.11 | Upgrade to 7.2.12 or above; FortiManager 7.0 | 7.0.0 through 7.0.15 | Upgrade to 7.0.16 or above
    Earlier version captured 3 Feb 2026, 01:15 UTC: archived copyLater version captured 21 Feb 2026, 11:20 UTC: archived copyRecovered from archived copiesSnapshots 808d80ebbc… and e4573e1a2f…Incident page

  3. FG-IR-26-060

    Changed without a revision note

    Administrative FortiCloud SSO authentication bypass

    Version table: 6 rows added and 4 rows removed. One new row reads "FortiAnalyzer 7.6 | 7.6.0 through 7.6.5 | Upgrade to 7.6.6 or above".

    • Fixed versions
    Version table rows
    BeforeFortiAnalyzer 7.6 | 7.6.0 through 7.6.5 | Upgrade to upcoming 7.6.6 or above; FortiManager 7.6 | 7.6.0 through 7.6.5 | Upgrade to upcoming 7.6.6 or above; FortiManager 7.2 | 7.2.0 through 7.2.11 | Upgrade to upcoming 7.2.13 or above; FortiOS 7.6 | 7.6.0 through 7.6.5 | Upgrade to upcoming 7.6.6 or a
    AfterFortiAnalyzer 7.6 | 7.6.0 through 7.6.5 | Upgrade to 7.6.6 or above; FortiManager 7.6 | 7.6.0 through 7.6.5 | Upgrade to 7.6.6 or above; FortiManager 7.2 | 7.2.0 through 7.2.11 | Upgrade to upcoming 7.2.12 or above; FortiOS 7.6 | 7.6.0 through 7.6.5 | Upgrade to 7.6.6 or above
    Earlier version captured 29 Jan 2026, 07:12 UTC: archived copyLater version captured 31 Jan 2026, 13:18 UTC: archived copyRecovered from archived copiesSnapshots 489f6a4225… and 6e2496bb6a…Incident page

  4. FG-IR-26-060

    Changed without a revision note

    Administrative FortiCloud SSO authentication bypass

    Version table: 3 rows added. One new row reads "FortiWeb 8.0 | 8.0.0 through 8.0.3 | Upgrade to upcoming 8.0.4 or above".

    • Fixed versions
    Version table rows
    Beforenot present
    AfterFortiWeb 8.0 | 8.0.0 through 8.0.3 | Upgrade to upcoming 8.0.4 or above; FortiWeb 7.6 | 7.6.0 through 7.6.6 | Upgrade to upcoming 7.6.7 or above; FortiWeb 7.4 | 7.4.0 through 7.4.11 | Upgrade to upcoming 7.4.12 or above
    Earlier version captured 28 Jan 2026, 02:01 UTC: archived copyLater version captured 28 Jan 2026, 19:27 UTC: archived copyRecovered from archived copiesSnapshots 8cd7570427… and 39cba51206…Incident page

  5. FG-IR-26-060

    Changed without a revision note

    Administrative FortiCloud SSO authentication bypass

    Version table: 3 rows added and 3 rows removed. One new row reads "FortiAnalyzer 7.4 | 7.4.0 through 7.4.9 | Upgrade to 7.4.10 or above". Workaround text changed.

    • Fixed versions
    • Workaround
    Version table rows
    BeforeFortiAnalyzer 7.4 | 7.4.0 through 7.4.9 | Upgrade to upcoming 7.4.10 or above; FortiManager 7.4 | 7.4.0 through 7.4.9 | Upgrade to upcoming 7.4.10 or above; FortiOS 7.4 | 7.4.0 through 7.4.10 | Upgrade to upcoming 7.4.11 or above
    AfterFortiAnalyzer 7.4 | 7.4.0 through 7.4.9 | Upgrade to 7.4.10 or above; FortiManager 7.4 | 7.4.0 through 7.4.9 | Upgrade to 7.4.10 or above; FortiOS 7.4 | 7.4.0 through 7.4.10 | Upgrade to 7.4.11 or above
    Workaround
    BeforeFortiCloud SSO authentication no longer supports login from devices running vulnerable versions. Therefore disabling FortiCloud SSO login on client side is not necessary at the moment. For reference, it can be nonetheless be done via the following: go to System -> Settings -> Switch "Allow administr
    AfterFortiCloud SSO authentication no longer supports login from devices running vulnerable versions. Therefore disabling FortiCloud SSO login on client side is not necessary at the moment. For reference, it can be nonetheless be done via the following: On FortiOS and FortiProxy: go to System -> Settings
    Earlier version captured 27 Jan 2026, 22:53 UTC: archived copyLater version captured 28 Jan 2026, 02:01 UTC: archived copyRecovered from archived copiesSnapshots 9a28e614bf… and 8cd7570427…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • FortiOS
  • FortiPAM
  • FortiProxy
  • FortiSwitchManager
How we built this timeline

Fortinet marked the advisory 'Known Exploited: Yes' from first publication (Wayback 20260415005955) and named the virtual patch 'FG-VD-59270.0day.', so exploitation was vendor-acknowledged at or before the fix: exploited before a fix=true. The exploitation details (PEERSTITCH, cluster CL-STA-0954, entry via FortiManager CVE-2024-47575) were only published by Unit 42 on 14 Oct 2026;

KEV followed on 16 Oct 2026. CVSS: the initial page showed 'CVSSv3 Score 5.4'; the current page shows base 6.0 with temporal 5.4; 6.0 used (medium either way).

NVD reportedly scores 6.5. Requires an authenticated admin with read-write permissions.

Branches told to migrate (no fix): FortiOS 7.2, 7.0, 6.4; FortiPAM 1.0-1.6;

FortiProxy 7.2, 7.0. Correction 23 Oct 2026 (R2): First fix now ≤ 27 Jan 2026 from FG-IR-26-060. exploited before a fix stays true: Unit 42 ties exploitation of this bug to an intrusion that began in September 2024, long before any fix.

Related

Fortinet report card