A sophisticated threat actor recently leveraged a path‑traversal vulnerability (CVE‑2025‑61624) in Fortinet’s FortiOS, FortiPAM, and FortiProxy to deliver a new ARM64 memory‑resident malware dubbed PeerStitch. The exploit bypasses security checks on tagged VPN sessions, allowing attackers to inject malicious code into legitimate traffic. The incident was first reported in early October, and affected systems include FortiGate firewalls and FortiPAM authentication appliances.
The vulnerability, rated CVSS 5.4, allows attackers to manipulate the command line interpreter and gain unauthorized access to the device’s file system. PeerStitch then resides in memory, avoiding detection by traditional signature‑based scanners. Analysts note that the malware can pivot across networks, exfiltrate data, and establish persistence without leaving obvious footprints. Fortinet has issued a patch for the flaw, but many organizations remain unpatched, leaving them exposed to this emerging threat.
PeerStitch exploits the flaw by crafting a specially formatted request that tricks the FortiOS interpreter into treating a malicious payload as a legitimate command. Once executed, the malware injects itself into the VPN session’s memory space, effectively hijacking the session. Because the payload is never written to disk, standard file‑based detection tools miss it. The malware also modifies system timers to delay its activity, further evading real‑time monitoring.
Fortinet’s security team confirmed that the vulnerability affects devices running FortiOS versions prior to 7.2.3. They recommend immediate patching and disabling of the vulnerable command line interface where possible. Security researchers emphasize that the attack chain requires an initial foothold, typically gained through phishing or compromised credentials, before the path‑traversal exploit can be applied.
Organizations relying on FortiGate firewalls should audit their firmware versions and apply the latest patches. The CVE identifier, CVE‑2025‑61624, is publicly documented, and the Fortinet advisory lists affected models and firmware releases. Security teams must also review VPN session logs for anomalous activity, such as repeated failed authentication attempts or unusual data flows.
In addition to patching, deploying network segmentation and enforcing least‑privilege access can limit the damage if an attacker gains a foothold. Multi‑factor authentication across all remote access points further reduces the risk of credential compromise, which is a prerequisite for the PeerStitch attack.
The threat actor’s use of a memory‑resident payload underscores the need for behavioral detection tools that monitor process activity and memory usage, rather than relying solely on signature checks. Fortinet’s own threat intelligence feed now includes indicators of compromise for PeerStitch, allowing security teams to correlate suspicious patterns.
If the flaw remains unpatched, attackers can silently inject PeerStitch into any VPN session that passes through the compromised device. The malware’s persistence mechanisms can survive reboots, and its ability to pivot across the network means that a single compromise can lead to widespread data exfiltration. The cost of a breach—both in remediation and reputational damage—can far outweigh the effort to apply a quick patch.
Security experts advise that organizations adopt a layered defense strategy: keep firmware up to date, monitor for anomalous VPN traffic, enforce strong authentication, and deploy behavioral analytics. Failure to do so risks exposure to an increasingly sophisticated threat landscape where memory‑resident malware can evade conventional defenses.
What is PeerStitch and how does it differ from other malware? PeerStitch is a new ARM64 memory‑resident malware that injects itself into VPN session memory, avoiding disk‑based detection. Unlike traditional file‑based threats, it remains in volatile memory, making it harder to discover with standard scanners.
Which Fortinet products are affected by CVE‑2025‑61624? The vulnerability impacts FortiOS, FortiPAM, and FortiProxy devices running firmware versions before 7.2.3. Users should verify their firmware version and apply the latest patch.
How can I protect my organization from this exploit? Apply the Fortinet patch immediately, disable the vulnerable command line interface if possible, enforce multi‑factor authentication, segment your network, and use behavioral monitoring tools to detect anomalous memory activity.