UNC5820 used Fortinet zero-days to plant PeerStitch at a telecom
CISA added CVE-2025-61624 to KEV; the memory-only implant rides legitimate FortiGate process traffic.
84
Product
FortiProxy
- Mentions · 7d0
- Mentions · 30d4
- All mentions8
- First seenAug 12, 2026
- Last mentioned11d ago
Timeline
8 articles · newest firstPEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
Unit 42 says CL-STA-0954 used Fortinet flaws to deploy memory-resident PEERSTITCH against a telecom provider.
84
CISA lists Fortinet path traversal CVE-2025-61624 as exploited
Authenticated admins with read-write rights can write or delete arbitrary files via CLI; the due date is October 19, 2026.
76
Double free in signal handler
A double-free in FortiOS, FortiProxy, and FortiSwitch lets a local user crash the newcli daemon.
24
Hackers Allegedly Selling Fortinet FortiGate 1-Day Vulnerability on Underground Forums
An unverified underground listing offers a claimed FortiGate SSL VPN RCE exploit for FortiOS 7.2.x/7.4.x amid ongoing exploitation of known Fortinet flaws.
64
Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension
Fortinet patched 10 vulnerabilities including two critical authentication flaws, CVE-2026-84390 (CVSS 9.6) and CVE-2026-84388 (CVSS 9.1), in FortiMonitorOnSight and the FortiPAM Chrome extension.
58
Fortinet security advisory (AV26-898)
Canadian Cyber Centre advisory AV26-898 flags Fortinet vulnerabilities across FortiOS, FortiProxy, FortiPAM, FortiSandbox and FortiMonitorOnSight, urging administrators to apply updates
26
Gunra Ransomware Exploits Fortinet FortiOS, FortiProxy Flaws to Breach Networks
CISA, FBI, and South Korean agencies warn Gunra ransomware, with 51 victims since April 2025, exploits Fortinet flaws for double-extortion attacks on critical infrastructure.
76
Related CVEs
by mentions- CVE-2025-616241%6.5Authenticated path traversal in Fortinet FortiOS and related products
- CVE-2024-4757595%9.8Unauthenticated RCE in Fortinet FortiManager and FortiManager Cloud
- CVE-2024-26008<1%5.3An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version…
- CVE-2024-5559194%9.8Unauthenticated Super-Admin Bypass in Fortinet FortiOS and FortiProxy
- CVE-2025-252494%9.8Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE
- CVE-2025-244727%8.1Authentication Bypass in Fortinet FortiOS and FortiProxy Grants Super-Admin Access
- CVE-2026-26084<1%9.9Improper Access Control in Fortinet FortiSandbox Exposes Sensitive Data
- Sensitive Information in Source Code in Fortinet FortiMonitorOnSight (CVSS 9.8)
- CVE-2026-84393<1%8.1Certificate Host-Mismatch Validation Flaw in FortiOS and FortiProxy ZTNA
- CVE-2024-26009<1%8.1An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16…
Appears with
- FortiOSproduct · 8
- Fortinetvendor · 8
- FortiPAMproduct · 5
- FortiSwitchManagerproduct · 4
- FortiGateproduct · 3
- CISAorganization · 3
- FortiManagerproduct · 3
- CL-STA-0954threat actor · 2
- Palo Alto Networksorganization · 2
- UNC5820threat actor · 2
- FortiSandboxproduct · 2
- FortiMonitorOnSightproduct · 2
- PeerStitchmalware · 2
- FortiSOARproduct · 1
- Gunramalware · 1
- KNPAorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.