PEERSTITCH Memory-Resident Implant Deployed via Chained FortiManager and FortiOS Flaws, Federal Deadline Today (CVE-2025-61624)

Scope: Fortinet FortiOS and FortiManager, devices previously exposed to the FortiJump vulnerability (CVE-2024-47575)

Severity: Red

A threat cluster tracked as CL-STA-0954, also known as UNC5820, chained a previously known FortiManager flaw dubbed FortiJump with a privilege escalation bug, CVE-2025-61624, to deploy PEERSTITCH, a memory-resident implant that builds a covert inter-process communication channel and avoids leaving persistent artifacts on disk, making it considerably harder to detect through standard monitoring. The attackers used this access to harvest configuration data including central management SQLite databases, establish unauthorised FortiGate SSL VPN sessions on perimeter firewalls, intercept network traffic, and maintain long-term access across the compromised environment. CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on October 16, 2026, with a federal deadline of today, October 19. Organisations running Fortinet infrastructure, particularly anything that was ever exposed to the earlier FortiJump flaw, must apply the fix today and treat the environment as potentially already compromised given the implant’s design specifically to evade detection. Review SSL VPN session configurations and FortiGate settings for anything unfamiliar, since this is exactly the kind of change the attackers used to maintain persistence.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.