CISA KEV Addition Follows PEERSTITCH FortiManager Exploitation, 500+ Firewalls Exposed

En bref

• CISA placed newly exploited vulnerabilities in its Known Exploited Vulnerabilities list this week.
• Researchers at Palo Alto Networks link PEERSTITCH to FortiManager exploitation.
• Over five hundred internet-facing firewalls are currently exposed.
• Scope includes Fortinet, BeyondTrust Remote Support, Palo Alto Networks, and firewalls.

This week CISA updated its Known Exploited Vulnerabilities list with flaws that attackers are already using. The addition is a signal that defenders should treat the associated products as active targets, not theoretical risk. For public-sector and school networks, KEV updates should trigger an immediate inventory check and a patching decision.

Researchers at Palo Alto Networks have been tracking PEERSTITCH, an actor tied to exploitation of FortiManager. FortiManager is a high-value management component, so a compromise there can affect the devices and workflows it controls. Teams should review FortiManager logs, administrative changes, and any unexpected outbound connections.

The exposure picture is broader than one appliance. More than 500 firewalls are exposed, and the relevant vendor and product scope includes Fortinet, BeyondTrust, and Palo Alto Networks, with FortiManager, Fortinet products, BeyondTrust Remote Support, and firewalls in view. That mix matters because remote-support tools and edge firewalls often sit on or near the public internet.

For K-12, these systems are frequently shared across districts and managed by small teams. An exposed firewall or remote-support portal can become a single point of failure for remote administration, filtering, and incident response. The absence of CVE identifiers in the facts provided means defenders should map vendor advisories and KEV entries to their own asset inventories rather than wait for a single tracking number.

What to watch: new KEV entries, vendor guidance for Fortinet and BeyondTrust, and evidence of PEERSTITCH activity. Confirm whether management interfaces are reachable from the internet, and prioritize any system that combines remote administration with weak authentication or flat network access.

À faire maintenant

1. Build an inventory of FortiManager, Fortinet devices, BeyondTrust Remote Support, Palo Alto Networks firewalls, and any internet-facing management interfaces; remove public access where not required.
2. Apply current Fortinet and BeyondTrust vendor fixes and mitigations, prioritizing FortiManager and edge firewalls; document exceptions.
3. Hunt for PEERSTITCH and FortiManager exploitation signs: review admin logins, configuration changes, new accounts, scheduled tasks, and unusual outbound traffic.
4. Enforce MFA, least privilege, and unique credentials for firewall and remote-support administration; rotate secrets if compromise is suspected.
5. Track CISA KEV updates and vendor advisories daily during this event; patch KEV-listed flaws within your emergency change window.
6. Segment management planes from user and internet networks; alert on anomalous administrative sessions and blocked inbound attempts.
7. Report confirmed or suspected intrusions through your incident-response channel and preserve logs before remediation.

Source originale

Security Affairs