CVE-2025-61624: FortiOS Path Traversal Exploited to Deploy PEERSTITCH ARM64 Malware — Detection and Remediation Guide

Fortinet edge devices remain one of the most consistently targeted assets in enterprise infrastructure, and this week's reporting confirms why. A suspected advanced threat actor has been observed exploiting CVE-2025-61624 — a path traversal vulnerability in the command-line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager — to deliver a previously unreported, memory-resident ARM64 implant tracked as PEERSTITCH.

Two elements of this campaign should sharpen every defender's attention. First, the vulnerability carries a modest CVSS score of 5.4, which means it likely sat below the priority line in many vulnerability management queues. Second, the malware is specifically engineered to bypass security checks on tagged VPN sessions — meaning the actor isn't just gaining a foothold, they're neutralizing the trust boundaries your remote access architecture depends on.

If you run FortiGate firewalls terminating VPN sessions, FortiPAM for privileged access, or FortiProxy/FortiSwitchManager anywhere in your environment, treat this as an active-exploitation event, not a routine patch Tuesday item.

Technical Analysis

Affected Products

Per the reporting, the vulnerable CLI interpreter component is shared across the Fortinet product line:

The shared-component nature of this flaw is the multiplier here. A single vulnerable code path in the CLI interpreter propagates across four product families — organizations running any combination of these should assume equivalent exposure.

The Vulnerability: CVE-2025-61624 (CVSS 5.4)

CVE-2025-61624 is a path traversal flaw in the command-line interpreter of the affected products. Path traversal in a CLI context means an attacker can escape the intended directory or command sandbox by injecting relative path sequences (../) into commands or arguments that the interpreter fails to canonicalize and validate.

From a defender's perspective, the exploitation chain based on current reporting looks like this:

1. Access prerequisite — The moderate CVSS score (5.4) typically reflects an exploitation requirement such as authenticated access or specific session context. This is consistent with the flaw living in the CLI interpreter rather than an unauthenticated web endpoint. Do not let the score lull you: authenticated-path bugs on edge devices are routinely chained with credential theft, session hijacking, or previously harvested admin tokens.
2. Traversal execution — Malicious path sequences submitted through the CLI allow the actor to read from or write to filesystem locations outside the intended scope.
3. Payload delivery — The traversal is leveraged to stage and execute PEERSTITCH, an ARM64-compiled implant (FortiGate hardware runs on ARM architecture in relevant models, which is why the actor built for ARM64 specifically).
4. Defense evasion — PEERSTITCH is memory-resident, leaving minimal on-disk artifacts, and it bypasses checks applied to tagged VPN sessions — effectively allowing the actor's traffic to ride through VPN policy enforcement that should otherwise inspect or restrict it.

PEERSTITCH: Why Memory-Resident Matters

Memory-resident malware on a network appliance is a worst-case forensic scenario:

• No persistent on-disk binary to hash, block, or scan with traditional AV-style controls.
• Reboot kills the implant — which sounds like a mitigation but actually destroys your evidence before IR can capture it. If you suspect compromise, capture memory and logs before rebooting.
• ARM64 compilation signals a deliberate, resourced actor. Nobody cross-compiles bespoke implants for appliance architectures opportunistically — this is targeted tradecraft consistent with the suspected advanced actor attribution.

The VPN Session Check Bypass

The most operationally dangerous capability reported is the bypass of checks on tagged VPN sessions. FortiGate VPN implementations apply policy, inspection, and logging decisions based on session attributes. If PEERSTITCH can manipulate how tagged sessions are evaluated, the actor gains:

• Unlogged or under-logged VPN traffic
• Evasion of SSL inspection or deep packet inspection on their sessions
• Persistence of access even through credential rotation, if session trust is being manipulated rather than credentials being replayed

Defensive implication: your VPN logs may be lying to you by omission. Absence of suspicious sessions in FortiGate VPN logs is not evidence of absence on a compromised device.

Exploitation Status

• Confirmed in-the-wild exploitation by a suspected advanced threat actor, per current reporting.
• The flaw is being used as a delivery mechanism for a novel implant, which strongly suggests the exploitation is mature and operationalized, not proof-of-concept spraying.
• Monitor the CISA Known Exploited Vulnerabilities (KEV) catalog — Fortinet CVEs with confirmed exploitation have historically been added rapidly, and KEV listing triggers binding remediation deadlines for federal agencies and serves as a de facto priority signal for everyone else.

Detection & Response

A critical caveat before the detections: because PEERSTITCH is memory-resident on the appliance itself, your highest-fidelity telemetry is FortiOS event logs forwarded off-box via syslog/CEF — CLI command audit logs, VPN session logs, and system event logs. If you are not already shipping FortiGate logs to a SIEM in near-real-time, that gap is now your top remediation item alongside patching. On-box logs cannot be trusted on a compromised device.

Sigma Rules

These rules target syslog-ingested FortiOS events. Field names assume a standard syslog pipeline; tune to your parser's field extraction.

---
title: FortiOS CLI Path Traversal Sequence in Command Audit Log
id: 3f8a1c92-6d47-4b15-9e02-a1c7d5f8e3b9
status: experimental
description: Detects path traversal sequences in FortiOS CLI command audit logs, consistent with exploitation of CVE-2025-61624 against the CLI interpreter. Forwarded via syslog from FortiGate, FortiPAM, FortiProxy, or FortiSwitchManager.
references:
  - https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  product: fortinet
  service: event
detection:
  selection:
    logdesc|contains:
      - 'Command executed'
    msg|contains:
      - '../'
      - '..\\'
      - '%2e%2e'
      - '..;/'
  condition: selection
falsepositives:
  - Rare; legitimate FortiOS CLI usage does not normally require relative path traversal sequences
level: high
---
title: FortiOS VPN Session Missing Expected Policy Tags
id: 9c2e4b71-3a58-4f06-b8d4-7e1a9f2c5d83
status: experimental
description: Detects VPN tunnel-up events lacking expected group/policy tag attributes, or sessions flagged with unusual tag values — a potential indicator of PEERSTITCH manipulating tagged VPN session checks. Requires baseline of expected tunnel group/policy names.
references:
  - https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.defense_evasion
  - attack.persistence
  - attack.t1078
logsource:
  product: fortinet
  service: vpn
detection:
  selection:
    action:
      - 'tunnel-up'
      - 'ssl-login'
  filter_known_groups:
    group:
      - 'VPN-Employees'
      - 'VPN-Contractors'
      - 'VPN-Admins'
  condition: selection and not filter_known_groups
falsepositives:
  - Newly provisioned VPN groups not yet added to the baseline list — maintain the allowlist
level: medium
---
title: FortiOS Configuration Change Followed by VPN Policy Modification
id: 5b7d3e18-2c49-4a61-8f37-0d4b6e8a1c92
status: experimental
description: Detects a CLI configuration change event closely associated with VPN policy or inspection profile modification — a post-exploitation pattern consistent with weakening session checks after PEERSTITCH deployment.
references:
  - https://attack.mitre.org/techniques/T1562/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.defense_evasion
  - attack.t1562
logsource:
  product: fortinet
  service: event
detection:
  selection:
    msg|contains:
      - 'vpn.ssl settings'
      - 'firewall policy'
      - 'ssl-ssh-profile'
      - 'deep-inspection'
    action|contains:
      - 'edit'
      - 'delete'
  condition: selection
falsepositives:
  - Legitimate firewall administration — correlate with change tickets and admin identity
level: medium

KQL — Microsoft Sentinel (Fortinet CEF/Syslog Ingestion)

FortiGate appliances ship logs to Sentinel via the Common Event Format connector into CommonSecurityLog. This query hunts for traversal sequences in CLI commands and anomalous VPN session patterns. Note: if the device is compromised, attacker-controlled sessions may not appear here at all — pair this with network-layer analytics (NetFlow, upstream firewall logs) that the actor cannot suppress.

// Hunt 1: Path traversal sequences in FortiOS CLI audit logs (CVE-2025-61624)
CommonSecurityLog
| where DeviceVendor =~ "Fortinet"
| where DeviceProduct has_any ("FortiGate", "FortiPAM", "FortiProxy", "FortiSwitch")
| where AdditionalExtensions has "cmd" or Message has "Command executed"
| extend CmdLine = extract(@"cmd=([^;]+)", 1, tostring(AdditionalExtensions))
| where CmdLine has_any ("../", "..\\", "%2e%2e", "..;/") or Message has_any ("../", "%2e%2e")
| project TimeGenerated, SourceIP, SourceUserName, DeviceName, CmdLine, Message
| order by TimeGenerated desc;

// Hunt 2: VPN sessions with missing or anomalous group/policy tags
CommonSecurityLog
| where DeviceVendor =~ "Fortinet"
| where DeviceEventCategory has_any ("tunnel-up", "ssl-login", "vpn")
| extend Group = extract(@"group=([^;]+)", 1, tostring(AdditionalExtensions))
| where isempty(Group) or Group !in ("VPN-Employees", "VPN-Contractors", "VPN-Admins") // tune to your baseline
| summarize SessionCount = count(), DistinctSources = dcount(SourceIP) by Group, SourceUserName, bin(TimeGenerated, 1h)
| order by SessionCount desc;

// Hunt 3: Admin CLI activity from unusual source IPs (pre-exploitation access vector)
CommonSecurityLog
| where DeviceVendor =~ "Fortinet"
| where Message has "login" and Message has_any ("ssh", "https", "cli")
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), count() by SourceIP, SourceUserName, DeviceName
| where count_ > 0
| order by FirstSeen desc;

Velociraptor VQL — Hunting Memory-Resident Tradecraft on Linux Infrastructure

Velociraptor does not run on FortiGate appliances, but PEERSTITCH's memory-resident, ARM64-compiled tradecraft is directly applicable to Linux servers and jump hosts the actor may touch after pivoting off the edge device. This artifact hunts for the classic in-memory execution pattern: processes whose backing binary has been deleted from disk (a hallmark of fileless/memfd-style implants).

-- Hunt for processes executing from deleted binaries or memfd (fileless malware pattern)
-- Deploy against Linux servers adjacent to Fortinet infrastructure (jump hosts, syslog collectors, VPN-adjacent services)
LET deleted_procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '\\(deleted\\)'
   OR Exe =~ '/memfd:'
   OR Exe =~ '/dev/shm/'
   OR Exe =~ '/run/shm/'

SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
       read_file(filename=format(format="/proc/%v/cmdline", args=Pid)) AS ProcCmdline
FROM deleted_procs

Follow up any hits with /proc/<pid>/maps review and a full memory acquisition before terminating the process.

Verification & Hardening Script (FortiOS CLI via SSH)

Run this against each FortiGate/FortiPAM/FortiProxy/FortiSwitchManager device to inventory version exposure, audit recent CLI activity, and check for signs of tampering. Do not reboot a device you suspect is compromised until logs and diagnostics are captured off-box.

#!/bin/bash
# CVE-2025-61624 / PEERSTITCH exposure check — run via SSH against each Fortinet device
# Usage: ./forti_check.sh <device_ip> <admin_user>

DEVICE="$1"
USER="$2"
OUTDIR="forti_ir_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTDIR"

echo "[*] Collecting from $DEVICE — output to $OUTDIR"

# 1. Firmware version — compare against Fortinet advisory fixed versions
ssh "$USER@$DEVICE" "get system status" | tee "$OUTDIR/${DEVICE}_version.txt"

# 2. Capture full config for offline diff against known-good baseline
ssh "$USER@$DEVICE" "show full-configuration" > "$OUTDIR/${DEVICE}_fullconfig.txt"

# 3. Recent CLI command audit log — hunt for traversal sequences
ssh "$USER@$DEVICE" "execute log filter category event
execute log filter field subtype cli
execute log display" > "$OUTDIR/${DEVICE}_cli_audit.txt"
grep -Ei '\.\./|\.\.\\|%2e%2e' "$OUTDIR/${DEVICE}_cli_audit.txt" && echo "[!!] TRAVERSAL SEQUENCE FOUND IN CLI LOG — ESCALATE"

# 4. Admin accounts and active sessions — look for unknown admins/sessions
ssh "$USER@$DEVICE" "show system admin" > "$OUTDIR/${DEVICE}_admins.txt"
ssh "$USER@$DEVICE" "get system session list" > "$OUTDIR/${DEVICE}_sessions.txt"

# 5. VPN session inventory — flag sessions missing expected group tags
ssh "$USER@$DEVICE" "diagnose vpn tunnel list
diagnose vpn ssl list" > "$OUTDIR/${DEVICE}_vpn.txt"

# 6. SSL inspection profile integrity — verify deep inspection not silently disabled
ssh "$USER@$DEVICE" "show firewall ssl-ssh-profile" > "$OUTDIR/${DEVICE}_sslprofile.txt"
grep -i 'deep-inspection' "$OUTDIR/${DEVICE}_sslprofile.txt" || echo "[!] Verify inspection profiles manually"

# 7. Verify syslog forwarding is active and reaching the SIEM
ssh "$USER@$DEVICE" "show log syslogd setting
diagnose log test" > "$OUTDIR/${DEVICE}_syslog.txt"

echo "[*] Collection complete. Review $OUTDIR before any remediation or reboot."
echo "[*] DO NOT reboot suspected-compromised devices — PEERSTITCH is memory-resident and reboot destroys forensic evidence."

Remediation

1. Patch immediately. Apply the fixed firmware releases per Fortinet's official advisory for CVE-2025-61624 at fortiguard.fortinet.com/psirt. Confirm the exact fixed version for your product train (FortiOS, FortiPAM, FortiProxy, FortiSwitchManager) in the advisory — do not assume a single version covers all trains. Monitor CISA KEV for addition of this CVE and associated remediation deadlines.

2. Do not trust patching alone if exploitation predates your patch window. Patching closes the hole; it does not evict an actor already inside. For any device that was exposed and internet-reachable before patching:

• Capture logs and diagnostics off-box first (the script above)
• Treat the device as potentially compromised and follow Fortinet's compromise-assessment guidance
• Rotate all credentials stored on or transiting the device: admin accounts, VPN user creds, LDAP/RADIUS bind accounts, API tokens, certificates

3. Constrain CLI and management-plane exposure. The vulnerable component is the CLI interpreter — reduce who can reach it:

• Restrict administrative access to dedicated management interfaces/VRFs and trusted host ACLs (config system admin → trusthost)
• Disable management access on WAN-facing interfaces entirely — this is non-negotiable hygiene for Fortinet edge devices
• Enforce MFA on all administrative and VPN access

4. Fix your logging posture. If FortiGate logs live only on the box, an attacker with this level of access owns your evidence. Forward event, VPN, and traffic logs via syslog/CEF to a SIEM in near-real-time and alert on forwarding gaps — a device that stops logging is itself a detection.

5. Validate VPN trust independently. Because PEERSTITCH bypasses tagged session checks, validate VPN activity against telemetry the actor doesn't control: upstream NetFlow, identity provider authentication logs (Entra ID/Okta sign-ins vs. FortiGate session claims), and EDR telemetry on connecting endpoints. Cross-source disagreement is your signal.

6. Hunt the pivot. A compromised edge device is a beachhead, not the objective. Audit authentication events originating from the FortiGate's IP space, review internal service accounts the device touches (LDAP binds, RADIUS), and run the Velociraptor fileless-malware hunt on adjacent Linux infrastructure.

The Bottom Line

A 5.4 CVSS score on a shared CLI component across four Fortinet product lines, exploited by an advanced actor to deliver bespoke ARM64 fileless malware that subverts VPN session trust — this is exactly the profile of vulnerability that severity-score-driven patch queues get wrong. If your triage process would have deprioritized CVE-2025-61624 based on score alone, this campaign is your case study for why exploitation status and asset criticality must outweigh raw CVSS. Patch the devices, verify the sessions, and assume the quiet logs are the ones lying to you.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub