CVE-2024-26009Vulnerability
Reported by 2 independent sources · first reported by Palo Alto Unit 42 · last reported
Last reported 8 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions“Although not definitive, it's suspected that the attackers may have exploited other flaws like CVE-2024-26009 and CVE-2024-26008 to carry out this task.”
-
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant“Exploitation of CVE-2024-26009 to bypass FGFM authentication using the FortiManager's serial number”
Indicators reported together
named in the same reports- 23.240.77[.]233in 2 reports
- 45.32.41[.]202in 1 report
- 198.199.122[.]22in 1 report
- system[.]autoin 1 report
- hxxp://23.240.77[.]233:8085/in 1 report
- b9fb0b27ddd59b58…533bb9cd1e70in 1 report
- 829b1cd270b30565…8ae4a0431f11in 1 report
- bd064244dad748cf…febd4c1fe02ain 1 report
- 9c4c4436ff5cdf0d…af7a7110437ein 1 report
- fc1b10c58057ef9f…a6e0312b36eein 1 report
- f84eea718526706a…8249c5e379abin 1 report
- b7ae166fd49a7ecf…fb7d14ce15a8in 1 report
- 8d969eef6ecad3c2…0c923adc6c92in 1 report
- hxxp://23.240.77[.]233:8085/pM.jsin 1 report
- hxxp://47.18.167[.]159:8085/pM.jsin 1 report
Copy these 15 indicators · defanged
Also named with it: CVE-2024-47575, CVE-2025-61624, CVE-2024-26008, CVE-2025-59718, CVE-2025-59719
Thanks — we review every report.