Vulnerabilities · 3h ago

FortiManager compromise exposed managed firewalls

Unit 42 says attackers exploited CVE-2024-47575 and CVE-2025-61624 in a September 2024 intrusion against a telecommunications managed service provider, starting with a FortiManager appliance and reaching more than 500 managed FortiGate firewalls. The team says the intruders also deployed PEERSTITCH, a memory-resident ARM64 implant, on FortiGate devices.

The key step was stealing running configurations, cryptographic material, and database files from the central manager. With those secrets, the attackers could impersonate FortiManager and talk to managed firewalls as trusted systems, which let them keep access, intercept traffic, and establish VPN sessions without repeatedly breaking each device.

That puts the lasting exposure on the managed fleet and the client networks behind it, not just on the manager or firewall that first fell. Separate Fortinet advisories also disclose new FortiSandbox and FortiSIEM flaws, so shops running multiple Fortinet platforms now have both a management-plane trust problem and fresh product bugs to sort out.

CVEs in this update

6 CVEs

Across FortiManager, fortimanager cloud, FortiOS, and related packages.

2 critical · 0 high · 3 medium · 0 low

1 in CISA KEV · 1 with EPSS above 1%

1 with functional or packaged public exploit code

Highest severity: CVE-2024-47575 · 9.8 CRITICAL

Highest EPSS: CVE-2024-47575 · 94.8%

Timeline

• Oct 16 Reported by The Hacker News
• Oct 15 Reported by Unit 42
• Oct 13 Reported by Fortinet PSIRT
• Nov 13 CISA federal deadline for CVE-2024-47575 passed
• Oct 23 CVE-2024-47575 added to CISA KEV

Sources

5 sources covering this story

• The Hacker News Oct 16

  PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

  Attackers exploited a patched FortiOS flaw to deploy PEERSTITCH, a memory-resident implant that bypasses checks on tagged VPN sessions.

• Unit 42 Oct 15

  Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

  We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware.

• NCSC-NL Advisories Oct 14

  Kwetsbaarheden verholpen in Fortinet FortiSandbox

  De kwetsbaarheid met kenmerk CVE-2026-107656 heeft een CVSS-score van 9,6 en betreft een authenticatieomzeiling in de webmanagementinterface van FortiSandbox.

• INCIBE-CERT Oct 14

  Múltiples vulnerabilidades en productos de Fortinet

  Gwendal Guégniaud y Adham El Karn, de Fortinet Product Security, junto con Jason McFadyen, de TrendAI

• Fortinet PSIRT Oct 13

  SQL command injection in webmail

  Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-26-184

• Fortinet PSIRT Oct 13

  GUI Denial of Service

  CVE-2026-106174: FortiOS >=7.6.4|<=7.6.6

• Fortinet PSIRT Oct 13

  Multiple Arbitrary File Read/Write via SQL Injection

  Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-26-178

• Fortinet PSIRT Oct 13

  Double free in signal handler

  Affected products: FortiOS, FortiProxy, FortiSwitch

• Fortinet PSIRT Oct 13

  Fabric API Authentication bypass

  CVE-2026-106172: FortiSandbox Cloud >=5.2.0|<=5.2.1

• Fortinet PSIRT Oct 13

  Broken authorization

  Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-26-183

• Fortinet PSIRT Oct 13

  Improper access control and session management in the web management interface

  CVE-2026-107656: FortiSandbox PaaS >=5.0.0|<=

• Fortinet PSIRT Oct 13

  arbitrary command execution in fgfmsd daemon

  Affected products: FortiManager, FortiManager Cloud

Entities

• CVE-2024-47575
• CVE-2025-61624
• CVE-2026-106173
• CVE-2026-107656

Vendor digest: Fortinet

Part of the PlainSec briefing for 2026-10-16

Editions

• Briefing for 2026-10-16

Related stories

• Cisco Secure Email Gateway flaw can spread in clusters
• Langflow flaw lets any account run server commands
• Windows Shell MotW bypass exploited in the wild