CVE-2024-26008Vulnerability
Reported by 3 independent sources · first reported by Palo Alto Unit 42 · last reported
Last reported 5 days ago
What the reports say
3 reports, newest first · the exact sentence from each-
Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack“…alo Alto Networks, UNC5820 asserted the management identity either by terminating the authentic FortiManager’s session by exploiting CVE-2024-26008, or by reusing exfiltrated secrets and authenticating as the legitimate FortiManager.”
-
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions“Although not definitive, it's suspected that the attackers may have exploited other flaws like CVE-2024-26009 and CVE-2024-26008 to carry out this task.”
-
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant“It is possible that the attackers forced this session termination using CVE-2024-26008, consistent with the intermittent tunnel management interface drops described in the Anti-Forensics and Defense Evasion section below.”
Indicators reported together
named in the same reports- 23.240.77[.]233in 2 reports
- 45.32.41[.]202in 1 report
- 198.199.122[.]22in 1 report
- system[.]autoin 1 report
- hxxp://23.240.77[.]233:8085/in 1 report
- b9fb0b27ddd59b58…533bb9cd1e70in 1 report
- 829b1cd270b30565…8ae4a0431f11in 1 report
- bd064244dad748cf…febd4c1fe02ain 1 report
- 9c4c4436ff5cdf0d…af7a7110437ein 1 report
- fc1b10c58057ef9f…a6e0312b36eein 1 report
- f84eea718526706a…8249c5e379abin 1 report
- b7ae166fd49a7ecf…fb7d14ce15a8in 1 report
- 8d969eef6ecad3c2…0c923adc6c92in 1 report
- hxxp://23.240.77[.]233:8085/pM.jsin 1 report
- hxxp://47.18.167[.]159:8085/pM.jsin 1 report
Copy these 15 indicators · defanged
Also named with it: CVE-2024-47575, CVE-2025-61624, CVE-2024-26009, CVE-2025-59718, CVE-2025-59719
Thanks — we review every report.