Unit 42 says attackers exploited CVE-2024-47575 and CVE-2025-61624 in a September 2024 intrusion against a telecommunications managed service provider, starting with a FortiManager appliance and reaching more than 500 managed FortiGate firewalls. The team says the intruders also deployed PEERSTITCH, a memory-resident ARM64 implant, on FortiGate devices.
The key step was stealing running configurations, cryptographic material, and database files from the central manager. With those secrets, the attackers could impersonate FortiManager and talk to managed firewalls as trusted systems, which let them keep access, intercept traffic, and establish VPN sessions without repeatedly breaking each device.
That puts the lasting exposure on the managed fleet and the client networks behind it, not just on the manager or firewall that first fell. Separate Fortinet advisories also disclose new FortiSandbox and FortiSIEM flaws, so shops running multiple Fortinet platforms now have both a management-plane trust problem and fresh product bugs to sort out.
5 sources · 4h ago
CVEs in this update
6 CVEs
Across FortiManager, fortimanager cloud, FortiOS, and related packages.
De kwetsbaarheid met kenmerk CVE-2026-107656 heeft een CVSS-score van 9,6 en betreft een authenticatieomzeiling in de webmanagementinterface van FortiSandbox.