Morgan Stanley cut Fortinet as CISA's October 19 patch deadline hits; keys still open 500 firewalls
CISA gave federal agencies until October 19 to patch CVE-2025-61624, the path-traversal flaw Unit 42 says delivered the PEERSTITCH implant after an intrusion that stole configurations, keys and credentials for more than 500 FortiGate firewalls. Fortinet reports Q3 billings on October 28, and the same installed base is both the bull case and the liability.
Vincent Jiang · 3 min read
On October 16, 2026, the Cybersecurity and Infrastructure Security Agency gave federal agencies three days to patch the Fortinet flaw CVE-2025-61624, with forensic triage required on anything already exposed 1. Morgan Stanley cut the stock to underweight the same day, and it closed about 7 percent lower at $169.13 23. The day's recaps filed the drop under a sector selloff that began with a Palo Alto Networks PAN-OS flaw, noting no negative company-specific news from Fortinet−7.60% — Fortinet, down 7.60 percent today 24. The company-specific news was two days old.
One appliance handed over 500 firewalls
Unit 42, the threat research arm of Fortinet's biggest rival, Palo Alto Networks−8.15% — Palo Alto Networks, down 8.15 percent today, published the details on October 14 5. The intrusion began in September 2024 at a telecommunications managed service provider, through the FortiJump flaw (CVE-2024-47575) in one FortiManager, the appliance that centrally administers FortiGate firewalls. The attackers left with running configurations, private keys and credentials for more than 500 managed FortiGates, passwords Unit 42 confirmed were recoverable 5. CVE-2025-61624, a path traversal in the FortiOS auto-script engine, then took them from administrator to root, to drop PEERSTITCH: an implant that lives only in memory and steers tagged VPN sessions past FortiOS security checks 5. Fortinet patched the flaw on April 14, 2026, and rated it medium, CVSS 6.0 against NIST's 6.5 67. The advisory now reads Known Exploited: Yes, and FortiOS 7.2, 7.0 and 6.4 get no fix, only migration 6.
Two banks, one installed base
TD Cowen raised its target to $225 from $215 on October 13, citing AI and data-center demand and second-half revenue growth above 20 percent 8. Three days later, Morgan Stanley's−0.77% — Morgan Stanley, down 0.77 percent today underweight call said the firewall refresh pool looks smaller than hoped 2. Both arguments run through the same fleet.
TD Cowen's October target sits $110 above the Street median
Data
| Value | |
|---|---|
| Evercore ISI, May 7 | $100 |
| Susquehanna, May 8 | $115 |
| Citigroup, May 8 | $115 |
| BTIG, May 26 | $150 |
| Barclays, 12 Jun | $155 |
| TD Cowen, 8 Jun | $160 |
| B of A, 8 Jun | $180 |
| TD Cowen, 13 Oct | $225 |
Second-quarter revenue was $2.048 billion, up 25.6 percent, product revenue rose 52 percent, and management lifted 2026 guidance to $8.02 billion to $8.18 billion of revenue and $9.35 billion to $9.55 billion of billings 91011. Third-quarter guidance is $2.01 billion to $2.10 billion of revenue and $2.25 billion to $2.35 billion of billings, reported on October 28, nine days after the patch deadline 210.
Fortinet revenue re-accelerated to 25.6 percent growth in Q2 2026
Data
| Revenue | |
|---|---|
| Q3 '23 | $1.34B |
| Q4 '23 | $1.42B |
| Q1 '24 | $1.35B |
| Q2 '24 | $1.43B |
| Q3 '24 | $1.51B |
| Q4 '24 | $1.66B |
| Q1 '25 | $1.54B |
| Q2 '25 | $1.63B |
| Q3 '25 | $1.73B |
| Q4 '25 | $1.91B |
| Q1 '26 | $1.85B |
| Q2 '26 | $2.05B |
Insiders sold the whole way up, and never bought
A Quiver Quantitative tally counts 39 open-market insider sales in six months and zero purchases. Founder and chief executive Ken Xie sold 327,469 shares for about $50.1 million; chief operating officer John Whittle sold about $9.4 million worth 2. After a 144.7 percent year-to-date run through October 12 and a $184.05 print on October 14, the week closed at $169.13 1083. Sales into a run prove little on their own. Zero purchases is the pattern.
What patching does not fix
Unit 42's scope note deserves equal weight: investigators examined the provider's environment only, and client networks had exposed configurations and credentials, not confirmed intrusions 5. An April patch and an October Known Exploited flag also sketch the bull case, because exposure forces the refresh TD Cowen expects 6. The caveat sits in the same report: trust material stolen from a management platform stays valid until every device it governed rotates it, so the compromise does not end when the platform is patched 5. The keys left in September 2024, and they still open the doors until someone changes the locks.
Deepdive
AI-generated from this story and its cited sources. Not investment advice.
