The Cybersecurity and Infrastructure Security Agency confirmed Friday that attackers are exploiting a flaw in several Fortinet products and ordered federal agencies to fix it by Monday, Oct. 19. Researchers at Palo Alto Networks reported this week that the same bug helped intruders steal configuration and credential data for more than 500 firewalls run by a telecommunications service provider for itself and its clients, showing how one compromised management console can expose many downstream customers.
What Happened
CISA added two flaws to its Known Exploited Vulnerabilities catalog, its list of bugs with evidence of active attacks, which federal civilian agencies must patch and many companies use to set priorities. One is CVE-2025-61624, a path traversal bug, a flaw that lets a user reach files outside the folders they should, in Fortinet's FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. The other is CVE-2026-102764, an authentication bypass in BeyondTrust Remote Support. CISA did not describe the evidence behind either listing.
The catalog entries set an Oct. 19 due date and flag both for forensic triage under CISA's Binding Operational Directive 26-04, meaning agencies must also look for signs of compromise from before the fix, not just install it. Ransomware use is listed as unknown.
Fortinet's advisory, first published April 14, rates the bug 6.0 out of 10, medium, because an attacker already needs administrator rights with write access; it then lets them write or delete arbitrary files. The advisory lists the flaw as known exploited. Fixes include FortiOS 7.6.5 and 7.4.10, FortiProxy 7.6.5 and 7.4.12, FortiPAM 1.7.1 and FortiSwitchManager 7.2.8 and 7.0.7; customers on older branches such as FortiOS 7.2, 7.0 and 6.4 must move to a fixed release.
In a separate alert, CISA said attackers are using the BeyondTrust flaw, in versions 26.2.3 and earlier, to get in, stay in, gain higher privileges and move across networks. It urged self-hosted customers to apply patch BT26-05-RS and said BeyondTrust-hosted deployments are already patched. Google this week tied the BeyondTrust attacks to a suspected Chinese espionage group; CISA did not attribute the attacks itself, though it pointed readers to Google's report. For suspected compromise, CISA tells organizations to isolate and image the appliance, hunt for unknown admin sessions and log gaps, rebuild from a known-good state, rotate every credential the appliance stored and review new multifactor sign-in registrations on privileged accounts.
What Researchers Found
In vendor research published Oct. 14, Palo Alto Networks' Unit 42 said a group it tracks as CL-STA-0954, also known as UNC5820, broke into the telecom provider in September 2024 through an older FortiManager flaw, CVE-2024-47575. It later used CVE-2025-61624 to gain root access, the highest level of control, on FortiOS and install an implant Unit 42 calls PEERSTITCH, which runs only in memory, opens no ports, makes no outbound connections and lets tagged VPN sessions skip normal checks.
The stolen archive held running configurations for more than 500 managed FortiGate firewalls, plus network maps, admin and VPN credentials in reversibly encrypted form, and certificates and private keys. Unit 42 said it did not examine client networks, so intrusions there are unconfirmed. It said parts of the activity overlap with intrusions attributed to suspected nation-state actors but named no country, and warned that the compromise "does not end when the platform is patched."
Why It Matters
A medium severity score can mislead. The Fortinet bug needs an insider-level foothold, but in this case attackers got that foothold through another flaw and then turned one management console into a map of hundreds of customer firewalls. Patching closes the hole; stolen passwords, keys and certificates stay valid until they are replaced.
Boards and executives whose networks are run by managed service providers should ask whether the provider's management platforms ran affected Fortinet versions, whether they were checked for compromise and whether stored credentials were rotated. Fortinet products have been targeted repeatedly this year, including the FortiBleed campaign and an exploited FortiMail flaw.
What to Watch
Federal agencies must remediate and complete forensic triage by Oct. 19. Open questions include whether other managed providers were hit, whether CISA's evidence goes beyond the Unit 42 case and who is behind the Fortinet activity.
