Critical
KEV-listed
CVE-2024-47575
CL-STA-0954 Exploits Fortinet Flaws to Deploy PEERSTITCH Malware
Vendor / product: Fortinet FortiManager, FortiGate
Event date: 2024-09-01
Victim organization: Telecommunications managed service provider
Public PoC: Yes
First tracked by RiskWire: 2026-10-16
CISA KEV catalog
Added to KEV
Federal remediation due
2024-11-13 (702 days overdue)
Ransomware campaign use
Unknown
CISA description
Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Named threat actors
CL-STA-0954UNC5820
Sources & citations (3)
- Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls cybersecuritynews.com · 2026-10-15
- PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions thehackernews.com · 2026-10-16
- Hackers Chain Fortinet Vulnerabilities to Deploy Memory-Resident Malware on Firewalls cyberpress.org · 2026-10-15
References
See CVE-2024-47575 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →