Threat reportVulnerabilityTL-2026-3921
Fortinet FortiOS/FortiPAM/FortiProxy/FortiSwitchManager CLI Path Traversal Privilege Escalation (CVE-2025-61624) Exploited by UNC5820 to Deploy PEERSTITCH
Fortinet FortiOS/FortiPAM/FortiProxy/FortiSwitchManager CLI (TL-2026-3921), also tracked as FG-IR-26-122, is a medium-severity software vulnerability scored CVSS 6, first published 2026-10-20. It is attributed to UNC5820 with low confidence, affects Fortinet FortiOS, references 3 CVEs (CVE-2025-61624, CVE-2024-47575, CVE-2024-26008), maps to 9 MITRE ATT&CK techniques (T1036, T1040, T1055), and is covered by 9 detection rules and 22 indicators of compromise.
- CVSS
- 6/10Medium
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 9MITRE ATT&CK
- Actors
- 2UNC5820
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-3921
- Threat ID
- TL-2026-3921
- Also known as
- FG-IR-26-122, PEERSTITCH, FortiJump (initial access CVE-2024-47575)
- Severity
- MEDIUM
- CVSS
- 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- UNC5820, CL-STA-0954
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- telecoms, managed-service-providers, industrial
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Fortinet FortiOS/FortiPAM/FortiProxy/FortiSwitchManager CLI
Malware and tooling: PEERSTITCH
How Fortinet FortiOS/FortiPAM/FortiProxy/FortiSwitchManager CLI works
CVE-2025-61624 is a path traversal flaw (CWE-22) in the FortiOS-family CLI that lets an authenticated administrator write or delete arbitrary files, escalating to root. CISA added it to KEV on 2026-10-16, and Palo Alto Unit 42 reports UNC5820 (CL-STA-0954) used it to deploy the memory-resident PEERSTITCH implant on FortiGate firewalls.
CVE-2025-61624 is an Improper Limitation of a Pathname to a Restricted Directory (CWE-22) weakness in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. An authenticated attacker with an admin profile and at least read-write permissions can write or delete arbitrary files through specifically crafted arguments to existing CLI commands, enabling security restriction bypass, data manipulation and elevation of privilege. Fortinet (FG-IR-26-122, published 2026-04-14, internally discovered) scores it CVSS 3.1 6.0 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, temporal 5.4); NVD scores it 6.5 (AV:N). Fortinet lists it as known exploited and ships a virtual patch signature (FG-VD-59270.0day, FMWP db update 25.120).
Unit 42 (published 2026-10-14) documents the exploitation: in the FortiOS CLI system.auto-script engine, '../' traversal sequences in the auto-script object name let the attacker place the script body at any filesystem location and have it run with elevated privileges, giving root on the underlying firewall OS. Observed traversal script names include '../../../../setup' and '../../tmp/apache2/conf/md-acme.conf'.
The activity is attributed to UNC5820 (tracked by Palo Alto Networks as CL-STA-0954), which Unit 42 describes as showing complex tradecraft overlapping with intrusions attributed to suspected nation-state actors. The victim was a telecommunications managed service provider compromised in September 2024 via FortiManager CVE-2024-47575 (FortiJump), which Mandiant reported exploited since 2024-06-27. The actor registered a rogue virtual FortiGate, used CVE-2024-26008 to terminate authentic FortiManager sessions, and exfiltrated configuration data covering more than 500 managed FortiGate firewalls, including credentials, configurations and cryptographic material. After an extended dwell period, CVE-2025-61624 was used to reach root and deploy PEERSTITCH.
PEERSTITCH is an ARM64 statically linked Linux ELF, delivered as a five-file chain (pM.js, index.js, index.wasm, ipssem.js, and the native lldprx binary) fetched from attacker-hosted HTTP servers on port 8085. It is memory-resident with no persistent binary on disk: a one-shot injector patches the running /bin/miglogd and /bin/iked daemons, writing a 1,344-byte payload into a 16,384-byte RWX buffer, applies NOP patches (0xAA0003E0) to suppress tamper checks and a 20-byte trampoline to redirect execution. It builds a covert inter-process bridge between the two daemons via /proc/<pid>/mem, keyed on a marker in traffic (TCP 8550, 169.254.0.1), and opens no listening ports and makes no outbound connections of its own. Unit 42 also describes abuse of the Apache mod_md ACME DNS-01 flow to obtain an SSH reverse shell.
Siemens SSA-975644 (2026-03-10, updated 2026-05-12) separately lists CVE-2025-61624 as affecting RUGGEDCOM APE1808 running Fortinet NGFW 7.4.10. HKCERT (2026-10-20) rates it Medium and states it is exploited in the wild, citing Fortinet and CISA. No public PoC was found in the sources reviewed. BeaconBeagle lookups for the two payload-hosting IPs returned HTTP 404, so no C2 correlation could be recorded.
MITRE ATT&CK techniques used in TL-2026-3921
Defense Evasion
T1036 Masquerading; T1055 Process Injection
Credential Access
Privilege Escalation
T1055 Process Injection; T1548 Abuse Elevation Control Mechanism
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol
Initial Access
T1190 Exploit Public-Facing Application
Collection
T1602 Data from Configuration Repository
defense-impairment
Affected products and versions in Fortinet FortiOS/FortiPAM/FortiProxy/FortiSwitchManager CLI
- Fortinet — FortiOS
Vulnerable versions: 6.4 (all); 7.0 (all); 7.2 (all); 7.4.0-7.4.9; 7.6.0-7.6.4
Fixed in: 7.4.10+; 7.6.5+ - Fortinet — FortiPAM
Vulnerable versions: 1.0-1.6 (all); 1.7.0
Fixed in: 1.7.1+ - Fortinet — FortiProxy
Vulnerable versions: 7.0 (all); 7.2 (all); 7.4.0-7.4.11; 7.6.0-7.6.4
Fixed in: 7.4.12+; 7.6.5+ - Fortinet — FortiSwitchManager
Vulnerable versions: 7.0.0-7.0.6; 7.2.0-7.2.7
Fixed in: 7.0.7+; 7.2.8+ - Siemens — RUGGEDCOM APE1808 (Fortinet NGFW)
Vulnerable versions: All versions running Fortinet NGFW below V7.4.11
Fixed in: Fortinet NGFW V7.4.11 or later
Remediation for Fortinet FortiOS/FortiPAM/FortiProxy/FortiSwitchManager CLI
Patches
- FortiOS 7.6.5+, 7.4.10+; migrate off 7.2, 7.0 and 6.4
- FortiPAM 1.7.1+; migrate off 1.0-1.6 (1.8 unaffected)
- FortiProxy 7.6.5+, 7.4.12+; migrate off 7.2 and 7.0
- FortiSwitchManager 7.2.8+, 7.0.7+
Immediate actions
- Apply Fortinet fixes per FG-IR-26-122 (CISA KEV due date 2026-10-19; BOD 26-04 requires forensic triage)
- Audit FortiOS configuration revisions and system.auto-script objects for '../' sequences in names
- Review admin accounts and CLI audit logs for unexpected read-write administrators and auto-script creation
- Deploy IPS virtual patch FG-VD-59270.0day (FMWP db update 25.120)
- Block and hunt for the network IOCs listed, including HTTP to ports 8084/8085 on 23.240.77.233 and 47.18.167.159
Workarounds
- Restrict administrative CLI access to the minimum set of trusted admins
- On suspected compromise, check running /bin/miglogd and /bin/iked for anonymous 16,384-byte rwxp mappings and 0xAA0003E0 patches, and review 'diagnose debug crashlog read' for Signal 11 crashes in those daemons
Longer-term hardening
- Restrict CLI and management-plane access to trusted networks and personnel with MFA
- Enable comprehensive CLI audit logging and forward it to the SIEM
- Apply file integrity monitoring to critical directories
- Rotate credentials and cryptographic material for devices managed by any FortiManager suspected compromised
CVEs associated with Fortinet FortiOS/FortiPAM/FortiProxy/FortiSwitchManager CLI
Weaknesses (CWE) in Fortinet FortiOS/FortiPAM/FortiProxy/FortiSwitchManager CLI
Timeline of Fortinet FortiOS/FortiPAM/FortiProxy/FortiSwitchManager CLI
- Mandiant reports UNC5820 exploiting FortiManager CVE-2024-47575 (FortiJump) from as early as this date to exfiltrate FortiGate configuration data.
- Telecommunications managed service provider compromised via CVE-2024-47575 (September 2024, exact day not stated); rogue virtual FortiGate registered and configuration data for 500+ managed firewalls exfiltrated.
- Public disclosure of CVE-2024-47575 (FortiJump) and Mandiant's UNC5820 findings.
- Siemens publishes SSA-975644 listing CVE-2025-61624 for RUGGEDCOM APE1808 (updated 2026-05-12).
- Fortinet publishes FG-IR-26-122 and the CVE-2025-61624 record (CVSS 6.0, internal discovery); fixes released.
- Unit 42 publishes analysis linking CVE-2025-61624 exploitation to PEERSTITCH deployment by CL-STA-0954 (UNC5820).
- CISA adds CVE-2025-61624 to the Known Exploited Vulnerabilities catalog.
- CISA KEV remediation due date for federal agencies under BOD 26-04.
- HKCERT bulletin rates the vulnerability Medium and states it is exploited in the wild.
Sources cited for Fortinet FortiOS/FortiPAM/FortiProxy/FortiSwitchManager CLI
- HKCERT: Fortinet Products Elevation of Privilege Vulnerability
- Fortinet PSIRT FG-IR-26-122
- NVD: CVE-2025-61624
- CISA KEV Catalog entry for CVE-2025-61624
- Unit 42: PEERSTITCH, a Stealthy FortiGate Implant
- SecurityWeek: Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
- Siemens SSA-975644 (RUGGEDCOM APE1808)
- SentinelOne Vulnerability Database: CVE-2025-61624
- BleepingComputer: Mandiant says new Fortinet FortiManager flaw has been exploited since June
Detection coverage for TL-2026-3921
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3921 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.