---
title: "Morgan Stanley cut Fortinet as CISA's October 19 patch deadline hits; keys still open 500 firewalls"
description: "CISA gave federal agencies until October 19 to patch CVE-2025-61624, the path-traversal flaw Unit 42 says delivered the PEERSTITCH implant after an intrusion that stole configurations, keys and credentials for more than 500 FortiGate firewalls. Fortinet reports Q3 billings on October 28, and the same installed base is both the bull case and the liability."
publisher: "The Inference"
section: "Markets"
published: 2026-10-18T19:16:47.568Z
modified: 2026-10-18T19:16:47.568Z
canonical: https://theinference.org/article/morgan-stanley-cut-fortinet-as-cisa-s-october-19-patch-deadline-hits-keys-still-open-500-firewalls
language: en
keywords: "Cybersecurity, Markets, Stocks, Insider Selling, Fortinet"
---

# Morgan Stanley cut Fortinet as CISA's October 19 patch deadline hits; keys still open 500 firewalls

> CISA gave federal agencies until October 19 to patch CVE-2025-61624, the path-traversal flaw Unit 42 says delivered the PEERSTITCH implant after an intrusion that stole configurations, keys and credentials for more than 500 FortiGate firewalls. Fortinet reports Q3 billings on October 28, and the same installed base is both the bull case and the liability.

On October 16, 2026, the Cybersecurity and Infrastructure Security Agency [gave federal agencies three days to patch the Fortinet flaw CVE-2025-61624](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), with forensic triage required on anything already exposed [1]. [Morgan Stanley cut the stock to underweight the same day](https://www.quiverquant.com/news/Fortinet+Falls+as+Analyst+Downgrade+Revives+Firewall+Refresh+Concerns), and it closed about 7 percent lower at $169.13 [2][3]. The day's recaps filed the drop under [a sector selloff that began with a Palo Alto Networks PAN-OS flaw](https://finance.yahoo.com/m/a764bc3f-d121-374d-982b-6a1e478db235/sell-off-in-cybersecurity.html), noting no negative company-specific news from [Fortinet](https://theinference.org/markets/companies/fortinet) [2][4]. The company-specific news was two days old.

## One appliance handed over 500 firewalls

Unit 42, the threat research arm of Fortinet's biggest rival, [Palo Alto Networks](https://theinference.org/markets/companies/palo-alto-networks), [published the details on October 14](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/) [5]. The intrusion began in September 2024 at a telecommunications managed service provider, through the FortiJump flaw (CVE-2024-47575) in one FortiManager, the appliance that centrally administers FortiGate firewalls. The attackers left with running configurations, private keys and credentials for more than 500 managed FortiGates, passwords Unit 42 confirmed were recoverable [5]. CVE-2025-61624, a path traversal in the FortiOS auto-script engine, then took them from administrator to root, to drop PEERSTITCH: an implant that lives only in memory and steers tagged VPN sessions past FortiOS security checks [5]. [Fortinet patched the flaw on April 14, 2026, and rated it medium](https://fortiguard.fortinet.com/psirt/FG-IR-26-122), CVSS 6.0 against [NIST's 6.5](https://nvd.nist.gov/vuln/detail/CVE-2025-61624) [6][7]. The advisory now reads Known Exploited: Yes, and FortiOS 7.2, 7.0 and 6.4 get no fix, only migration [6].

![Rear panel of a Fortinet FortiGate 6501F firewall appliance](https://storage.googleapis.com/theinference-public/img/b34e0833e4fb87da.png)

*A Fortinet FortiGate 6501F firewall. CISA's October 19 deadline covers CVE-2025-61624, a path traversal in the FortiOS software these appliances run. (Premeditated)*

## Two banks, one installed base

TD Cowen [raised its target to $225 from $215 on October 13](https://www.ad-hoc-news.de/boerse/news/corporate-news/td-cowen-raises-target-for-fortinet-stock-from-usd-215-to-usd-225/70327659), citing AI and data-center demand and second-half revenue growth above 20 percent [8]. Three days later, [Morgan Stanley](https://theinference.org/markets/companies/morgan-stanley)'s underweight call said the firewall refresh pool looks smaller than hoped [2]. Both arguments run through the same fleet.

*Chart: **TD Cowen's October target sits $110 above the Street median** Bar chart of analyst price targets on Fortinet stock, ranging from $100 at Evercore ISI to TD Cowen's $225 October raise, with the $115 Street median marked*

*Twelve-month price targets on FTNT compiled by Quiver Quantitative, May to June 2026, plus TD Cowen's October 13, 2026, raise; median of 19 targets in the same tally. [2][8]*

[Second-quarter revenue was $2.048 billion, up 25.6 percent](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001262039), product revenue rose 52 percent, and management lifted 2026 guidance to $8.02 billion to $8.18 billion of revenue and $9.35 billion to $9.55 billion of billings [9][10][11]. Third-quarter guidance is $2.01 billion to $2.10 billion of revenue and $2.25 billion to $2.35 billion of billings, reported on October 28, nine days after the patch deadline [2][10].

*Chart: **Fortinet revenue re-accelerated to 25.6 percent growth in Q2 2026** Line chart of Fortinet quarterly revenue from Q3 2023 to Q2 2026, rising from $1.335 billion to $2.048 billion with growth accelerating in 2026*

*Quarterly revenue in USD billions from Fortinet's SEC filings, calendar quarters, retrieved October 18, 2026. [9]*

## Insiders sold the whole way up, and never bought

A Quiver Quantitative tally counts 39 open-market insider sales in six months and zero purchases. Founder and chief executive [Ken Xie](https://theinference.org/markets/people/ken-xie) sold 327,469 shares for about $50.1 million; chief operating officer [John Whittle](https://theinference.org/markets/people/john-whittle) sold about $9.4 million worth [2]. After a 144.7 percent year-to-date run through October 12 and a $184.05 print on October 14, the week closed at $169.13 [10][8][3]. Sales into a run prove little on their own. Zero purchases is the pattern.

## What patching does not fix

Unit 42's scope note deserves equal weight: investigators examined the provider's environment only, and client networks had exposed configurations and credentials, not confirmed intrusions [5]. An April patch and an October Known Exploited flag also sketch the bull case, because exposure forces the refresh TD Cowen expects [6]. The caveat sits in the same report: trust material stolen from a management platform stays valid until every device it governed rotates it, so the compromise does not end when the platform is patched [5]. The keys left in September 2024, and they still open the doors until someone changes the locks.

## Takeaway

CISA's October 19 patch deadline, Morgan Stanley's underweight call and October 28 billings all run through the same Fortinet fleet, and keys stolen in September 2024 stay valid until every device they governed rotates them.

## Sources

1. [CISA, Known Exploited Vulnerabilities Catalog (entry for CVE-2025-61624), accessed 18 October 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
2. [Quiver Quantitative, "Fortinet Falls as Analyst Downgrade Revives Firewall Refresh Concerns", 16 October 2026](https://www.quiverquant.com/news/Fortinet+Falls+as+Analyst+Downgrade+Revives+Firewall+Refresh+Concerns)
3. [Traders Union, "Fortinet stock falls 4.8% to $173.22" (close $169.13, -7.06%), 16 October 2026](https://tradersunion.com/news/companies/show/3848338-fortinet-stock-falls-4-8percent-to/)
4. [Investor's Business Daily via Yahoo Finance, "Sell-Off In Cybersecurity Stocks Intensifies Amid Palo Alto Vulnerability", 16 October 2026](https://finance.yahoo.com/m/a764bc3f-d121-374d-982b-6a1e478db235/sell-off-in-cybersecurity.html)
5. [Palo Alto Networks Unit 42 (Daniel Gott, Shawn Westfall), "Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant", 14 October 2026](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)
6. [Fortinet PSIRT, advisory FG-IR-26-122, "Path Traversal in CLI" (CVE-2025-61624), 14 April 2026](https://fortiguard.fortinet.com/psirt/FG-IR-26-122)
7. [NIST National Vulnerability Database, CVE-2025-61624 detail, last modified 16 October 2026](https://nvd.nist.gov/vuln/detail/CVE-2025-61624)
8. [ad-hoc-news, "TD Cowen raises target for Fortinet stock from USD 215 to USD 225" (event of 13 October 2026, via Investing.com)](https://www.ad-hoc-news.de/boerse/news/corporate-news/td-cowen-raises-target-for-fortinet-stock-from-usd-215-to-usd-225/70327659)
9. [Fortinet quarterly figures from its SEC filings, via company_series, retrieved 18 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001262039)
10. [Zacks via Yahoo Finance, "Does Fortinet's Strong Margin Profile Make the Stock Worth Buying Now?", 12 October 2026](https://finance.yahoo.com/markets/stocks/articles/does-fortinets-strong-margin-profile-160100355.html)
11. [ad-hoc-news, "Fortinet stock gained 1.76 percent before October 28 results" (Q2 product revenue, $184.13 print), 6 October 2026](https://www.ad-hoc-news.de/boerse/news/corporate-news/fortinet-stock-gained-1-76-percent-before-october-28-results/70242495)


---

Morgan Stanley cut Fortinet as CISA's October 19 patch deadline hits; keys still open 500 firewalls — The Inference. Canonical: https://theinference.org/article/morgan-stanley-cut-fortinet-as-cisa-s-october-19-patch-deadline-hits-keys-still-open-500-firewalls