A suspected state-backed actor exploited two Fortinet vulnerabilities to obtain long-term access to an unnamed telecommunications organization, according to Palo Alto Networks findings reported by SecurityWeek.
The intrusion occurred in September 2024. Investigators track the actor as UNC5820, which Palo Alto Networks maps to CL-STA-0954. The operation began with the compromise of a central FortiManager system and progressed to the deployment of PeerStitch, an in-memory implant targeting FortiGate appliances.
During the attack, the intruder exfiltrated an archive containing information about the FortiManager installation, the victim’s network and more than 500 managed FortiGate firewalls. That figure describes the devices represented in the stolen configuration data, not 500 firewalls confirmed as compromised.
One of the exploited flaws, CVE-2025-61624, entered the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog on October 16, 2026. The remediation deadline for US federal civilian agencies is October 19, 2026.
From FortiManager compromise to firewall control
Palo Alto Networks described the initial entry point as CVE-2024-47575, also known as “FortiJump.” The critical FortiManager vulnerability lacks authentication for a sensitive function, allowing remote attackers to run arbitrary commands or code through specially constructed requests.
After exploiting the management server, the actor registered a rogue Virtual FortiGate appliance with FortiManager. This provided a route to the configuration archive containing details about the centrally managed firewalls and network environment.
The NVD assigns CVE-2024-47575 a CVSS score of 9.8, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and classifies it as CWE-306.
Affected releases listed in the NVD description are:
- FortiManager 7.6.0
- FortiManager 7.4.0 through 7.4.4
- FortiManager 7.2.0 through 7.2.7
- FortiManager 7.0.0 through 7.0.12
- FortiManager 6.4.0 through 6.4.14
- FortiManager 6.2.0 through 6.2.12
- FortiManager Cloud 7.4.1 through 7.4.4
- FortiManager Cloud 7.2.1 through 7.2.7
- FortiManager Cloud 7.0.1 through 7.0.12
- FortiManager Cloud 6.4.1 through 6.4.7
Mandiant had observed UNC5820 exploiting the flaw since at least June 2024, according to the reporting. Fortinet patched it in October 2024, when it was identified as having been exploited as a zero-day. CISA added it to KEV on October 23, 2024, with a federal remediation deadline of November 13, 2024.
CVE-2025-61624 delivered PeerStitch
The same intrusion also involved CVE-2025-61624, a path-traversal vulnerability affecting FortiOS, FortiPAM, FortiProxy and FortiSwitchManager.
NVD says an authenticated attacker with an administrator profile and at least read-write permissions can use specific CLI commands to write or delete arbitrary files. It assigns the flaw a CVSS score of 6.0 and the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H.
The score reflects the high privileges required under the vulnerability’s general attack conditions. In the telecom intrusion described by Palo Alto Networks, however, the attacker had already compromised the management environment. Researchers said UNC5820 used the flaw to obtain root access to the underlying FortiOS system and place a script that initiated PeerStitch’s deployment.
Fortinet patched CVE-2025-61624 in April 2026 and flagged it as zero-day exploitation at disclosure. The NVD description lists these affected versions:
- FortiOS 7.6.0 through 7.6.4
- FortiOS 7.4.0 through 7.4.9
- All FortiOS 7.2, 7.0 and 6.4 versions
- FortiPAM 1.7.0 and all versions in the 1.6 through 1.0 branches
- FortiProxy 7.6.0 through 7.6.4
- FortiProxy 7.4.0 through 7.4.11
- All FortiProxy 7.2 and 7.0 versions
- FortiSwitchManager 7.2.0 through 7.2.7
- FortiSwitchManager 7.0.0 through 7.0.6
The NVD product summary identifies FortiOS 7.4.10, FortiPAM 1.7.1, FortiProxy 7.4.12 and FortiSwitchManager 7.0.7 as relevant version thresholds. Those thresholds do not cover every affected branch in the fuller NVD description, including FortiOS and FortiProxy 7.6 releases and several older branches.
PeerStitch hides inside legitimate appliance processes
Palo Alto Networks characterized PeerStitch as an ARM64 implant written in C. Rather than installing a conventional persistent executable, it acts as a one-time injector that modifies running process memory.
The implant reportedly targets three areas of FortiOS:
- the central management system;
- the traffic-logging component;
- the daemons supporting IKE/IPsec VPN services.
PeerStitch does not open a listening port or initiate its own outbound connection, according to the researchers. It instead passes data through traffic produced by legitimate appliance processes, creating a covert in-memory communication bridge among its targets. Palo Alto Networks said this design bypassed default FortiOS security checks and reduced the disk artifacts available to investigators.
The actor then impersonated FortiManager in FortiGate-to-FortiManager, or FGFM, communications, enabling commands to be sent from external infrastructure. Researchers also reported extensive efforts to remove forensic traces.
Palo Alto Networks offered two possible methods for taking over the management identity. The actor may have disrupted the legitimate FortiManager session using CVE-2024-26008, or it may have authenticated with secrets obtained from the exfiltrated configuration data.
CVE-2024-26008 is an FGFM daemon vulnerability that can let an unauthenticated attacker repeatedly reset a connection through crafted SSL-encrypted TCP requests. The available account does not establish which of the two methods was used in this intrusion.
What Fortinet administrators should do
US federal civilian agencies must remediate CVE-2025-61624 by October 19, 2026. CISA directs agencies to apply vendor mitigations, comply with BOD 26-04 Prioritizing Security Updates Based on Risk and follow its Forensics Triage Requirements. For cloud services, agencies must follow the applicable BOD 26-04 guidance or discontinue the product if mitigations are unavailable.
Other organizations using the affected products should also prioritize the flaw because its KEV listing reflects observed exploitation. Administrators should:
- upgrade FortiOS 7.4 to 7.4.10 or later, FortiPAM to 1.7.1 or later, FortiProxy 7.4 to 7.4.12 or later, and FortiSwitchManager 7.0 to 7.0.7 or later;
- apply the vendor-prescribed fixed release or mitigation for affected branches not covered by those thresholds;
- verify that CVE-2024-47575 has been addressed on every FortiManager and FortiManager Cloud instance;
- examine FortiManager for unauthorized Virtual FortiGate registrations;
- review unexpected FGFM sessions, particularly management traffic involving external infrastructure;
- replace management credentials and secrets where configuration archives may have been exposed;
- include volatile-memory and management-plane evidence in forensic triage rather than relying only on files stored on disk.
For CVE-2024-47575, CISA’s required action remains to apply Fortinet’s mitigations or discontinue use of the affected product if mitigations are unavailable.
