Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware.
Excerpt from the primary source: Palo Alto Networks Unit 42
Who is affected
Small businesses · Enterprises · Security professionals
Affected technology: FortiGate / FortiOS
Why it matters
CISA lists this as exploited in the wild. Unpatched FortiGate / FortiOS systems are exposed to active attacks now.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Act now
Treat this as an emergency. Identify every system running FortiGate / FortiOS, apply the vendor's fix or published mitigations immediately, and check for signs of compromise. Patching alone does not remove an attacker who already got in.
CISA's required action for CVE-2024-47575: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." US federal civilian agencies must comply by November 13, 2024.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Security research
Related
Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products
Critical-severity flaws could lead to authentication bypass, code execution, and sensitive authentication information leaks.
Apply the vendor's security update for FortiGate / FortiOS and Ivanti Connect Secure / EPMM.
FortiBleed Attackers Locking Victims Out of Fortinet Devices
Attackers are creating new accounts and deleting existing ones and passwords to prevent legitimate access.
FBI, Secret Service add to warnings of FortiBleed credential stealing campaign
Users of two types of Fortinet hardware should take steps to limit their exposure to a now-global credential stealing campaign, U.S. federal law enforcement says.
Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) is being actively exploited, CISA warns
CISA added CVE-2026-104286 (Fortinet FortiMail) to its Known Exploited Vulnerabilities catalog on October 1, 2026, which means there is reliable evidence of exploitation in the wild. Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or…
CISA lists this as exploited in the wild. Unpatched FortiGate / FortiOS and FortiMail systems are exposed to active attacks now.
Treat this as an emergency.