---
title: Tip: for Fortinet CVE-2025-61624, patch and also audit who holds read-write admin, because stolen configs supply the credentials | ctxsec
url: https://ctxsec.com/items/tip-fortinet-61624-admin-audit
description: ""
status: "how-to"
published: 2026-10-16
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-fortinet-61624-admin-audit.md)

how-to

2026-10-16

### Tip: for Fortinet CVE-2025-61624, patch and also audit who holds read-write admin, because stolen configs supply the credentials

The bug needs a privileged admin, so the patch alone isn't the whole fix. Upgrade FortiOS to 7.6.5 or 7.4.10 (or migrate off 7.2, 7.0 and 6.4), FortiProxy to 7.6.5 or 7.4.12, FortiPAM to 1.7.1 and FortiSwitchManager to 7.2.8 or 7.0.7. Then list every admin profile with read-write rights, remove stale or shared accounts, rotate admin passwords and any secrets in configs that FortiManager held, and restrict management interfaces to trusted hosts. Check for unexpected auto-scripts, since Unit 42 saw the PEERSTITCH actor use this bug through an auto-script path traversal. Fortinet also offers virtual patch FG-VD-59270.0day in FMWP db 25.120.

Sources: [Fortinet PSIRT FG-IR-26-122](https://fortiguard.fortinet.com/psirt/FG-IR-26-122) · [Unit 42: PEERSTITCH](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)