US cybersecurity agency CISA has added a Fortinet path-traversal flaw to its Known Exploited Vulnerabilities catalogue after it was used by malware to compromise more than 500 firewalls. The flaw, tracked as CVE-2025-61624, affects Fortinet products and was exploited by malware known as PEERSTITCH, which used the FortiOS auto-script engine to deploy an implant and maintain stealthy access.

How the attacks worked

Reporting on the CISA listing describes a path-traversal weakness that allowed attackers to reach parts of the system they should not have been able to access, and then to install a persistent implant on affected firewalls. Because firewalls sit at the edge of a network, a compromised firewall can give an attacker a powerful vantage point, including visibility of traffic passing through it and a foothold for further movement inside the network.

Why firewalls are a priority target

Security teams often focus patching on servers and desktops, but internet-facing security appliances are themselves high-value targets. They are always on, always reachable, and often run older firmware because administrators are reluctant to reboot them. CISA's listing, made on 19 October 2026 alongside the BeyondTrust flaw covered in a previous DailyByte brief, urged organisations to review the catalogue and address the flaws. Federal agencies were given a short deadline to patch, and private-sector organisations were urged to follow the same priority.

Administrators running Fortinet products should check CISA's catalogue entry, apply the available fix, and look for signs of compromise, including unexpected scripts or implants on their firewalls. A patch alone does not remove an implant installed before the patch, so checking for compromise matters as much as updating.