Fortinet Flaws Chained to Deploy PeerStitch in Telecom

Palo Alto Networks Unit 42 published findings today on a Fortinet exploitation chain used to plant a memory-resident implant inside a telecommunications organization. The threat actor is tracked as UNC5820, also designated CL-STA-0954 by Unit 42. Nation-state attribution has not been confirmed.

Initial access

Entry point: CVE-2024-47575. Missing authentication in FortiManager’s fgfmd daemon. CVSS 9.8, unauthenticated remote code execution. CISA added it to the Known Exploited Vulnerabilities catalog in October 2024.

After gaining FortiManager access, UNC5820 registered a rogue virtual FortiGate appliance and exfiltrated configuration data covering more than 500 managed firewalls. The actor also used a separate FortiManager flaw to terminate legitimate FortiManager sessions, according to Unit 42.

Escalation

Second CVE: CVE-2025-61624. Path traversal in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. CVSS 6.0. An authenticated attacker with admin-level read-write access can write or delete arbitrary files via specific CLI commands. CISA added it to KEV on October 16, 2026. The federal patch deadline was today, October 19.

Unit 42 states the actor used this flaw to obtain root access on targeted FortiGate devices following the FortiManager compromise.

The PeerStitch implant

Unit 42 designates the malware PeerStitch. ARM64, written in C. It operates as a “one-shot process memory patching injector,” a description from the Unit 42 report. Memory-only operation: nothing is written to disk, and forensic artifacts were eliminated after deployment.

Once injected, PeerStitch patches process memory to open covert inter-process communication channels. Targets include VPN service daemons, IKE/IPsec processes, and traffic logging. Traffic the implant generates blends with legitimate process activity. Unit 42 characterizes the technique as showing “increasing technical maturity of edge-device malware.”

Patch status

Both CVEs carry vendor patches and CISA KEV entries. CVE-2024-47575 has been patchable since October 2024; its EPSS score is 0.95 per FIRST.org as of October 14, 2026. CVE-2025-61624 was patched in April 2026 and its federal remediation deadline passed today.

Analysis: the memory-only, artifact-eliminating profile of PeerStitch is consistent with a threat actor optimizing for persistent access over detectable impact. Confidence: medium, based on Unit 42 reporting alone.

For broader Fortinet KEV context: Fortinet Flaw CVE-2025-25249 Used in PivotC2 RAT Attacks, Fortinet FortiMail Zero-Day CVE-2026-104286 in KEV, and the October Patch Tuesday roundup covering Fortinet fixes.

Source: Palo Alto Networks Unit 42.