---
title: 'CISA adds Fortinet flaw to the KEV catalog (CVE-2025-61624)'
url: 'https://securteksecurity.com/news/cisa-kev-fortinet-cve-2025-61624-peerstitch'
markdown: 'https://securteksecurity.com/news/cisa-kev-fortinet-cve-2025-61624-peerstitch.md'
date: '2026-10-16'
description: 'CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on October 16, 2026, with federal agencies required to apply the fixes by October 19. The flaw is a path traversal vulnerability in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager: an atta…'
taxonomy:
  category:
    - Cybersecurity
---

# [CISA adds Fortinet flaw to the KEV catalog (CVE-2025-61624)](https://securteksecurity.com/news/cisa-kev-fortinet-cve-2025-61624-peerstitch)

   16th Oct 2026  

CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on October 16, 2026, with federal agencies required to apply the fixes by October 19. The flaw is a path traversal vulnerability in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager: an attacker who already holds an administrator profile with read-write rights can write or delete arbitrary files by passing crafted arguments to existing commands. Fortinet patched the flaw in April 2026 and rates it medium, a score that reflects the privileged access required rather than the impact once that access is held.

Palo Alto Networks Unit 42 tracks the exploitation as CL-STA-0954, also tracked as UNC5820. The intrusion began with the FortiManager flaw CVE-2024-47575, which exposed configurations, credentials, and trust material for more than 500 managed FortiGate firewalls. The attackers then used CVE-2025-61624 to escape the restricted administrator CLI to root and deploy PEERSTITCH, a memory-only implant that hooks the miglogd and iked daemons to bypass security checks on tagged VPN sessions. The implant leaves no file on disk, opens no listening ports, and makes no outbound connections, and the actor cleared crash logs and deleted rogue administrator accounts and auto-scripts afterward.

Sources: [SecurityAffairs](https://securityaffairs.com/201178/security/u-s-cisa-adds-fortinet-multiple-products-and-beyondtrust-remote-support-flaws-to-its-known-exploited-vulnerabilities-catalog.html); [The Hacker News](http://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [CISA adds Atlassian flaw to the KEV catalog (CVE-2026-21589)](https://securteksecurity.com/news/cisa-kev-atlassian-cve-2026-21589.md)
- Next: [CISA adds actively exploited Ivanti Connect Secure zero-day to the KEV catalog](https://securteksecurity.com/news/cisa-kev-ivanti-connect-secure-zero-day-cve-2026-104935.md)