CISAAnalysisCISA adds Fortinet auto-script path traversal to KEV catalog
What happened.CISA added an actively exploited path traversal flaw in the Fortinet auto-script CLI engine to its Known Exploited Vulnerabilities catalog.
Why it matters.Next-generation enterprise firewalls terminate encrypted site-to-site tunnels and enforce zero-trust boundary segmentation. When threat actors plant memory-resident implants inside security gateways, they intercept decrypted tunnel sessions and evade endpoint detection tools without writing persistent files to disk. Network teams must apply vendor patches immediately and examine running process memory for unauthorized hooks.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2025-61624 and Fortinet advisory FG-IR-26-122, an improper pathname limitation in system.auto-script allows authenticated administrators to access restricted file paths.
- Exploitation path: Threat groups chain the traversal defect to elevate privileges to root and deploy PEERSTITCH, a memory-resident firewall implant that hooks system daemons to hijack VPN sessions.
- Remediation releases: Fortinet published maintenance updates across FortiOS, FortiProxy, and FortiPAM releases, while CISA mandated that federal civilian agencies remediate exposed devices and conduct memory artifact triage.
STORYLINE PROGRESSION & CONTEXT
This report represents a verified evolution of prior newsroom intelligence: