PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware. The attack exploits a CVSS 5.4 path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that bypasses checks on tagged VPN sessions.

Sources

• The Hacker News

Story so far

1. 2026-10-16 PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions – The Hacker News
   first report
2. 2026-10-16 PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager – Security Affairs
   added to CISA KEV

Fact-checked against the sources above before publishing. AI-assisted script, synthetic voice, human-approved. Found an error? Tell us.

#Fortinet#Apple#Malware#Cybersecurity