CVE-2025-61624

What is FortiOS?

FortiOS is the operating system that runs Fortinet's FortiGate firewalls, and the same codebase underpins FortiProxy (secure web gateway), FortiPAM (privileged access management), and FortiSwitchManager. These appliances sit at the network perimeter, terminate SSL VPN sessions, broker administrative access, and hold the configuration and credential material for everything behind them.

Administration happens largely through a purpose-built CLI. Among its features is system.auto-script, which lets an administrator store a named script object on the appliance and have the system execute it. That engine runs with high privilege, which is precisely what makes a filename-handling bug in it worth chaining to.

Overview

CVE-2025-61624 is a path traversal flaw in the command line interpreter shared by FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. An attacker who already holds an administrator profile with at least read-write permissions can supply crafted command arguments that write or delete arbitrary files outside the intended directory. Fortinet scores it 6.0 (Medium) on CVSS v3, with a temporal score of 5.4; the vector is local and requires high privileges, which is why the number looks unremarkable for a KEV entry.

The CVSS score understates it. In practice this is the bridge between "compromised FortiOS admin account" and "root on the firewall," and that is exactly how it has been used. Fortinet published the fix on 2026-04-14 in advisory FG-IR-26-122, flagging it as internally discovered and already known to be exploited. CISA added it to the KEV catalog on 2026-10-16, the same day Palo Alto Networks Unit 42 published research documenting the exploitation chain in detail.

That research is what moved this from a quiet Medium to a catalogued, actively exploited bug. Unit 42 found it while investigating a prolonged intrusion at a telecommunications managed service provider, where the flaw served as the privilege-escalation step in a campaign that ended with a previously unreported memory-resident implant inside FortiGate daemons.

Affected Versions

Technical Details

The root cause is CWE-22, improper limitation of a pathname to a restricted directory. In plain words: the CLI took a name supplied by the administrator and used it to build a file path without first stripping out directory-traversal sequences such as ../. Feeding it a name full of ../ segments walks the write out of the directory the developers intended and anywhere on the filesystem the privileged process can reach.

Unit 42 places the bug specifically in the system.auto-script engine, where the script object name is not sanitised. A script object named ../../../../setup is therefore written outside the auto-script directory, and because the auto-script engine executes with high privilege, the planted file runs as root. The same technique with a different target path, ../../tmp/apache2/conf/md-acme.conf, was used to drop a configuration file rather than a script.

Exploitation requires authentication as an administrator with read-write rights, so this is not a pre-auth entry point. Attack complexity is low and a single crafted CLI command is enough. Treat it as a post-compromise escalation primitive: its value to an attacker depends entirely on having already obtained admin credentials by some other means.

Discovery

Fortinet credits the discovery to its own internal security team, with no external researcher named in FG-IR-26-122. The advisory was published on 2026-04-14 and marked the issue as known exploited at the time of release, meaning Fortinet was aware of in-the-wild abuse before or around disclosure.

The public technical detail came later and from a different source. Palo Alto Networks Unit 42 documented the exploitation chain on 2026-10-16 in its PEERSTITCH report, which is also what prompted the wider coverage and, the same day, the KEV listing.

Exploitation Context

Unit 42 tracks the activity as CL-STA-0954, overlapping with UNC5820, and describes it as a suspected advanced threat actor; no formal nation-state attribution is made. The intrusion began in September 2024 against a telecommunications managed service provider, which means the exploitation predates the April 2026 advisory and the flaw was in use as an unpatched issue for a considerable period.

The chain ran as follows. Initial access came from CVE-2024-47575 (FortiJump) against a FortiManager appliance, from which the attackers exfiltrated configurations, credentials, and trust material for more than 500 managed FortiGate firewalls. Credentials recovered from those configurations were cracked and used to open SSL VPN sessions into perimeter firewalls. CVE-2025-61624 then escalated FortiOS administrative access to root on the underlying OS, dropping the PEERSTITCH loader. Unit 42 also assesses with lower confidence that CVE-2024-26009 and CVE-2024-26008 were used to impersonate FortiManager and force session terminations.

PEERSTITCH itself is a memory-resident ARM64 ELF that leaves no binary on disk, opens no listening ports, and makes no outbound connections. It uses ptrace to patch /bin/miglogd and /bin/iked in memory, then has the two daemons talk to each other through /proc/<pid>/mem. Marker values (TCP port 8550 and IP 169.254.0.1) tag a VPN session, and iked then takes an alternate code path that skips default FortiOS security validations. A second auto-script abused Apache's mod_md ACME module to create an SSH reverse shell. Anti-forensics included killing miglogd and syslogd, clearing crash logs, and rolling back the malicious auto-script objects and rogue accounts. No count of implanted devices has been published, and there is no reported ransomware use.

Remediation

1. Upgrade to a fixed release: FortiOS 7.6.5 or 7.4.10 and above; FortiProxy 7.6.5 or 7.4.12 and above; FortiPAM 1.7.1 and above; FortiSwitchManager 7.2.8 or 7.0.7 and above. FortiOS 7.2, 7.0, and 6.4, FortiProxy 7.2 and 7.0, and FortiPAM 1.6 and earlier have no fix in branch and must be migrated. Use Fortinet's upgrade path tool at https://docs.fortinet.com/upgrade-tool.
2. If you cannot patch immediately, apply the FortiGuard virtual patch FG-VD-59270.0day, available in FMWP database update 25.120.
3. Restrict and audit administrative access. Because exploitation requires an admin account with read-write permissions, the practical mitigation is to cut the number of such accounts, bind administrative access to a management network or trusted-host list, and require MFA. Do not expose management interfaces to the internet.
4. Review system.auto-script objects for names containing ../ or other traversal sequences, and for scripts you did not create. Note that the observed actor deliberately rolled these objects back after use, so absence is not proof of safety.
5. Hunt for the PEERSTITCH indicators: unexpected ptrace activity against /bin/miglogd and /bin/iked, files staged under /data2/template/, retrieval from hxxp[:]//23.240.77[.]233:8085/, an md-acme.conf under /tmp/apache2/conf/, and VPN sessions referencing 169.254.0.1 or TCP 8550.
6. Check for gaps in forwarded logs and missing crash logs. The implant kills miglogd and syslogd and clears crash logs, so an unexplained silence in off-box syslog is itself a signal. Rely on external log collection, not on the appliance.
7. If you also run FortiManager, confirm CVE-2024-47575 is patched and review whether managed FortiGate configurations and credentials were exposed. Rotate any credentials held in those configurations, including VPN and local admin accounts.
8. Federal civilian agencies had until 2026-10-19 to remediate under BOD 22-01. Given that a memory-resident implant survives in RAM and that the actor removes its own artefacts, appliances suspected of compromise should be rebooted into a known-good patched image and have credentials rotated rather than simply updated in place.