Apply Fortinet-released patches for CVE-2025-61624 immediately. Update FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager to the latest patched versions. Deploy FortiSandbox or IPS signatures to detect PEERSTITCH activity. Monitor for unauthorized command line interpreter access and anomalous VPN session behavior.
Quick answers
What is CVE-2025-61624?
Apply Fortinet-released patches for CVE-2025-61624 immediately. Update FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager to the latest patched versions. Deploy FortiSandbox or IPS signatures to detect PEERSTITCH activity. Monitor for unauthorized command line interpreter access and anomalous VPN session behavior.
How severe is CVE-2025-61624?
high, CVSS 5.4
Is CVE-2025-61624 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2025-61624 be mitigated?
Apply Fortinet-released patches for CVE-2025-61624 immediately. Update FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager to the latest patched versions. Deploy FortiSandbox or IPS signatures to detect PEERSTITCH activity. Monitor for unauthorized command line interpreter access and anomalous VPN session behavior.
CVSS
5.4
Vendor
Fortinet
Published
Oct 17, 2026 · 05:58
Patch
Unknown / not confirmed
Affected products
FortiOS, FortiPAM, FortiProxy, FortiSwitchManager
Mitigation
Apply Fortinet-released patches for CVE-2025-61624 immediately. Update FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager to the latest patched versions. Deploy FortiSandbox or IPS signatures to detect PEERSTITCH activity. Monitor for unauthorized command line interpreter access and anomalous VPN session behavior.
A suspected advanced threat actor has been observed exploiting a path traversal vulnerability in Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager to deploy a previously unreported memory-resident ARM64 malware strain known as PEERSTITCH. The flaw (CVSS 5.4) resides in the command line interpreter and allows unauthorized file access, with attackers bypassing security checks on tagged VPN sessions. Patches have been released by Fortinet.
