PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
At a glance
- Severity
- MediumCVSS 6.0
- Used in attacks
- Not on CISA’s list
- Flaws named
- CVE-2025-61624
- Vendors and products
- Fortinet
- Reported by
- 1 outlet
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a…
We summarise and link; this source is not one we hold a licence to reproduce. Everything below is what CyberBrief adds: the vulnerabilities involved, whether they are being exploited, who is named, and who else covered it.
Vulnerabilities referenced
- CVE-2025-616246.0Medium
Fortinet Fortios
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
Patch or advisory available
Full record →
Fastnexa security experts
Dealing with this in your own company?
If this story touches software, suppliers or systems you use, a Fastnexa security expert can tell you what it means for you and what to do first.
Think you’ve already been hit? Don’t wait on a form: call or WhatsApp +1 (732) 454 2616. We reply within 1 hour, 24/7. Emergency help →
Coverage
One outlet has carried this so far.
2026-10-16 04:59 UTC
Related stories
- UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
The Hacker News · 2026-10-16
- Networking problems after the October 2026 Windows update? NTLM might be to blame
The Register · 2026-10-16
- China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns
Infosecurity Magazine · 2026-10-16
- Microsoft: October Windows update may break Smart App Control
BleepingComputer · 2026-10-16
- China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The Hacker News · 2026-10-16