What happened

• CISA added CVE-2025-61624 to the Known Exploited Vulnerabilities catalog on 2026-10-16, based on evidence of active exploitation [S2].
• The flaw is a path traversal in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager [S1][S2].
• Exploitation needs an authenticated attacker with an admin profile and read-write permissions. Such an attacker can write or delete arbitrary files through specific CLI commands [S2].
• CISA BOD 26-04 guidance requires forensic triage for this KEV entry before patching, to check whether the system was already compromised [S4].
• Secondary reporting says suspected state actor UNC5820 / CL-STA-0954 chained FortiJump (CVE-2024-47575) with CVE-2025-61624 against a telecom's FortiManager and pushed a PeerStitch implant to over 500 managed FortiGates. The pipeline could not retrieve this report, so it is uncorroborated [S3].

Timeline

Detect

Fortinet admin CLI sessions that write or delete files · FortiOS / FortiProxy / FortiPAM / FortiSwitchManager system event logs (syslog or FortiAnalyzer forward)

index=* devid=* type="event" subtype="system" (ui="*cli*" OR ui="ssh*" OR ui="jsconsole*" OR ui="console*") (action="delete" OR msg="*delete*" OR msg="*upload*" OR msg="*restore*" OR msg="*execute*" OR msg="*../*") | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as msg values(ui) as ui by devname user

A hit means: An admin session ran CLI commands that write, delete or restore files. That is the activity CISA ties to this flaw [S2][S4]. Confirm the user, source and change window before treating it as malicious.

Rare successful admin logins on affected Fortinet devices · FortiOS / FortiProxy / FortiPAM / FortiSwitchManager system event logs

index=* devid=* type="event" subtype="system" logdesc="Admin login successful" | stats count min(_time) as first_seen max(_time) as last_seen values(ui) as ui by devname user | where count<5

A hit means: An admin account logged in rarely, or from an unusual interface or source. Exploitation needs a read-write admin [S2], so an unexpected admin session is a precondition worth checking.

Verify

• Match each CLI file write or delete against change tickets and the named admin's own account of the work [S4].
• Compare the device's current files and config against a known-good backup taken before 2026-10-16 [S2][S4].
• Benign look-alikes: scheduled config backups and restores, firmware upgrades, certificate or script uploads by admins, and automation or orchestration accounts (for example FortiManager pushes).
• A hit is stronger if the admin session came from an IP outside your management ranges, or used an account created or changed recently.

Scope

Affected

• FortiOS [S1][S2]
• FortiPAM [S1][S2]
• FortiProxy [S1][S2]
• FortiSwitchManager [S1][S2]

Only if

• The attacker is authenticated with an admin profile that has read-write permissions [S2]

Not affected if

None stated by the sources.

Fixed in: See Fortinet advisory FG-IR-26-122. Fixed versions are not stated in the provided sources.

Enumerate

• Every FortiOS, FortiPAM, FortiProxy and FortiSwitchManager instance, with its running version.
• All admin accounts with read-write profiles, including local, RADIUS/LDAP-mapped and API accounts.
• Management interface exposure for each device: trusted hosts, and internet reachability.
• FortiManager instances and the devices they manage, given the uncorroborated FortiManager reporting [S3].
• How long log retention covers each device, back to at least before 2026-10-16.

Contain

• Export system event logs and full config backups from each affected device before any change. Patching or rebooting can destroy volatile evidence, and that loss cannot be undone [S4].
• Restrict administrative access to trusted management hosts. Disable admin access on internet-facing interfaces.
• Review read-write admin accounts. Disable any you cannot attribute, and reset credentials for accounts seen in suspicious sessions.
• Complete the forensic triage required by BOD 26-04, then apply the FG-IR-26-122 update [S4][S2].
• Isolate or take offline any device where triage finds unauthorized file writes or deletions. Keep a copy of its state for analysis.

Eradicate

• Remove any unauthorized admin accounts, and any files written through the flaw that triage finds [S2].
• The provided sources do not describe persistence for this CVE. If an implant such as the reported PeerStitch is suspected, follow vendor guidance on reimaging or firmware reinstall [S3, uncorroborated].

Recover

• Before restoring, confirm each device runs the fixed release from FG-IR-26-122 and that its config matches a known-good baseline [S2].
• Confirm admin access is limited to trusted hosts and that only approved read-write accounts remain.
• Afterwards, keep running the CLI file-activity and rare-admin-login hunts, and watch for config or firmware pushes from FortiManager.

Re-enter the loop when

• Fortinet or CISA publish IoCs, or name a threat actor or implant for CVE-2025-61624.
• The FortiJump (CVE-2024-47575) plus CVE-2025-61624 chain or PeerStitch is corroborated by a primary source [S3].
• FG-IR-26-122 is revised to add products or versions, or to change the precondition from authenticated admin.
• Triage finds a compromised device, or finds FortiManager pushes to managed devices that you cannot account for.

Debrief

• Record each affected device, its version, patch date and forensic triage result, as BOD 26-04 requires [S4].
• Record any admin sessions that triage could not attribute, and how long logs were retained.
• Gap: the sources give no fixed versions, exploitation details, IoCs or attribution for CVE-2025-61624.
• Gap: the PeerStitch / UNC5820 / FortiManager claims are uncorroborated [S3].

Detection coverage — checked automatically

Checked automatically 2026-10-31 19:33Z from public sources: 21 published, 24 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2024-47575

vuln:CVE-2024-26008

vuln:CVE-2025-61624

cpe:"cpe:/a:fortinet:fortimanager"

product:"Fortimanager"

host.services: (software.product = "Fortimanager")

cpe:"cpe:/a:fortinet:fortimanager_cloud"

product:"Fortimanager Cloud"

host.services: (software.product = "Fortimanager Cloud")

cpe:"cpe:/a:fortinet:fortiproxy"

product:"Fortiproxy"

host.services: (software.product = "Fortiproxy")

cpe:"cpe:/a:fortinet:fortiswitchmanager"

product:"Fortiswitchmanager"

host.services: (software.product = "Fortiswitchmanager")

http.title:"FortiManager"

http.title:"FortiProxy"

NVD names 2 more affected products (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Banner spellings: a model read 5 from the NVD names and this card's text (former and marketing names, console titles); 2 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-31 19:33Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Is the FortiJump + CVE-2025-61624 chain and the PeerStitch implant real? The only linked report returned unrelated content [S3].
• The story cites CVE-2024-26008 as an alias for FortiJump, but FortiJump is CVE-2024-47575. Is this a conflation of two CVEs [S3]?
• The S3 story is dated 2026-10-20, after the 2026-10-19 brief date, in a thread described as oldest first. Is the date or the ordering wrong?
• Which fixed versions does FG-IR-26-122 list, and which specific CLI commands are abused?
• Does a FortiManager compromise widen exposure for managed FortiGates beyond the admin-credential precondition?

Sources

• [S1] https://www.cisa.gov/known-exploited-vulnerabilities-catalog · Cybersecurity and Infrastructure Security Agency (CISA)
• [S2] https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog · Cybersecurity and Infrastructure Security Agency (CISA)
• [S3] https://www.securityweek.com/exploited-fortinet-bug-linked-to-stealthy-fortigate-implant-in-telecom-hack/ · SecurityWeek
• [S4] https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk · Cybersecurity and Infrastructure Security Agency (CISA)

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.