UNC5820 used Fortinet zero-days to plant PeerStitch at a telecom
CISA added CVE-2025-61624 to KEV; the memory-only implant rides legitimate FortiGate process traffic.
84
Product
FortiPAM
- Mentions · 7d0
- Mentions · 30d3
- All mentions6
- First seenSep 9, 2026
- Last mentioned11d ago
Timeline
6 articles · newest firstPEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
Unit 42 says CL-STA-0954 used Fortinet flaws to deploy memory-resident PEERSTITCH against a telecom provider.
84
CISA lists Fortinet path traversal CVE-2025-61624 as exploited
Authenticated admins with read-write rights can write or delete arbitrary files via CLI; the due date is October 19, 2026.
76
Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension
Fortinet patched 10 vulnerabilities including two critical authentication flaws, CVE-2026-84390 (CVSS 9.6) and CVE-2026-84388 (CVSS 9.1), in FortiMonitorOnSight and the FortiPAM Chrome extension.
58
Fortinet security advisory (AV26-898)
Canadian Cyber Centre advisory AV26-898 flags Fortinet vulnerabilities across FortiOS, FortiProxy, FortiPAM, FortiSandbox and FortiMonitorOnSight, urging administrators to apply updates
26
FortiPAM Chrome Extension Vulnerability Lets Malicious Sites Control Browser Proxy and Record Tabs
Fortinet patched CVE-2026-84388 (CVSS 9.1) in its FortiPAM Chrome extension, letting malicious websites alter proxy settings, open tabs and record sessions.
48
Related CVEs
by mentions- CVE-2025-616241%6.5Authenticated path traversal in Fortinet FortiOS and related products
- CVE-2024-4757595%9.8Unauthenticated RCE in Fortinet FortiManager and FortiManager Cloud
- CVE-2026-84388<1%9.6Unauthenticated UI-Layer Flaw in Fortinet FortiPAM Chrome Extension
- CVE-2024-26008<1%5.3An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version…
- CVE-2026-26084<1%9.9Improper Access Control in Fortinet FortiSandbox Exposes Sensitive Data
- Sensitive Information in Source Code in Fortinet FortiMonitorOnSight (CVSS 9.8)
- CVE-2026-84393<1%8.1Certificate Host-Mismatch Validation Flaw in FortiOS and FortiProxy ZTNA
- CVE-2024-26009<1%8.1An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16…
Appears with
- Fortinetvendor · 6
- FortiProxyproduct · 5
- FortiOSproduct · 5
- FortiSwitchManagerproduct · 3
- FortiManagerproduct · 3
- Palo Alto Networksorganization · 2
- FortiGateproduct · 2
- FortiMonitorOnSightproduct · 2
- CISAorganization · 2
- PeerStitchmalware · 2
- CL-STA-0954threat actor · 2
- UNC5820threat actor · 2
- FortiSandboxproduct · 2
- unnamed telecommunications managed service providervictim · 1
- FortiAnalyzerproduct · 1
- Unit 42organization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.