CISA ADDS ACTIVELY EXPLOITED FORTINET AND BEYONDTRUST VULNERABILITIES TO KEV CATALOG

THREAT SUMMARY

Category: Actively Exploited Vulnerabilities
Affected Product(s): Fortinet multiple products, BeyondTrust Remote Support
CVE(s): CVE-2025-61624, CVE-2026-102764
Primary Risks: Path traversal, authentication bypass, unauthorized access, exposure of protected resources, and potential follow-on compromise depending on the affected product and exploitation conditions
Threat Status: Active exploitation confirmed by CISA
Affected Environment(s): Organizations operating vulnerable Fortinet products or BeyondTrust Remote Support deployments
Attack Vector(s): Path traversal and authentication bypass by spoofing
CISA Action: Two vulnerabilities added to the Known Exploited Vulnerabilities Catalog on October 16, 2026
Required Response: Federal Civilian Executive Branch agencies must follow BOD 26-04 risk-based remediation requirements. CISA encourages all organizations to prioritize remediation of KEV-listed vulnerabilities.

---

CISA has added two actively exploited vulnerabilities affecting Fortinet products and BeyondTrust Remote Support to its Known Exploited Vulnerabilities Catalog after determining that both have evidence of exploitation in real-world attacks.

The October 16 additions are CVE-2025-61624, identified by CISA as a path traversal vulnerability affecting multiple Fortinet products, and CVE-2026-102764, identified as an authentication bypass by spoofing vulnerability affecting BeyondTrust Remote Support.

Both vulnerabilities affect technologies that can occupy important positions inside enterprise, government, and managed IT environments. Fortinet products are widely used across network-security infrastructure, while BeyondTrust Remote Support is designed to provide controlled remote access and support capabilities. Vulnerabilities affecting those types of systems warrant elevated attention because the affected technology may sit close to administrative access, network controls, remote-management functions, or sensitive organizational resources.

CISA’s October 16 alert does not identify affected product versions, CVSS scores, named threat actors, exploit chains, vulnerability-specific indicators of compromise, or detailed post-exploitation behavior for either vulnerability. Those details should remain tied to applicable vendor guidance. What CISA has established is that both vulnerabilities are being actively exploited, which places them into immediate remediation priority.

---

Vulnerability Details

CVE-2025-61624 — Fortinet Multiple Products Path Traversal Vulnerability

CISA identifies CVE-2025-61624 as a path traversal vulnerability affecting multiple Fortinet products. Path traversal vulnerabilities can occur when software does not adequately restrict how file or directory paths are processed, potentially allowing an attacker to reach files, directories, or system resources outside the intended location.

The actual impact depends on the affected product, the vulnerable component, the permissions available to that component, and the conditions required for successful exploitation. CISA’s alert does not specify which Fortinet products or versions are affected, what files or resources may be exposed, whether authentication is required, or whether exploitation can lead to additional access.

The phrase multiple products is important because organizations should not assume that one Fortinet appliance or platform is the only asset requiring review. Administrators should identify every Fortinet product operating within the environment and compare exact deployments against the applicable vendor remediation information associated with CVE-2025-61624.

The active-exploitation designation changes the urgency. CVE-2025-61624 is not being treated as a vulnerability that may become important later. CISA has determined that exploitation evidence already exists, which means vulnerable systems should be located and remediated without being left inside a routine patch queue.

---

CVE-2026-102764 — BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

CISA identifies CVE-2026-102764 as an authentication bypass by spoofing vulnerability affecting BeyondTrust Remote Support.

Authentication controls exist to determine whether a person, device, service, or process should be permitted access to a protected environment. A vulnerability that allows authentication to be bypassed weakens that trust boundary by creating conditions under which an unauthorized actor may be able to circumvent the mechanism intended to restrict access.

The affected product makes this category especially significant. Remote-support platforms are built to provide controlled administrative or technical access to systems that may otherwise be inaccessible from outside the local environment. Their usefulness depends heavily on strong identity verification, restricted permissions, session control, and reliable authentication.

CISA’s October 16 alert does not specify the affected versions of BeyondTrust Remote Support, the exact spoofing mechanism, the privileges available after successful exploitation, whether prior access is required, or whether exploitation is limited to specific configurations. Those technical details should not be inferred from the vulnerability title.

The confirmed fact remains serious: CVE-2026-102764 is being actively exploited.

---

Affected Products and Environments

CISA identifies two affected product groups in the October 16 alert: Fortinet multiple products and BeyondTrust Remote Support. The alert does not provide affected-version ranges, so organizations should use applicable vendor remediation information to determine whether specific deployments are vulnerable.

Priority asset review should include:

• All Fortinet products that could fall within the scope of CVE-2025-61624.
• BeyondTrust Remote Support deployments used for remote administration or technical support.
• Internet-facing instances and externally reachable management interfaces.
• Secondary, standby, failover, and disaster-recovery systems.
• Older or legacy installations that may remain connected to production environments.
• Test, staging, and laboratory systems that may not follow the primary patch cycle.
• Deployments managed by outside providers or third-party administrators.
• Remote offices or distributed environments operating independent instances of the affected products.

Organizations should verify the entire asset footprint before declaring remediation complete. Security and remote-access products can operate for long periods, and secondary appliances may receive less attention than the primary production environment. A single overlooked deployment can preserve exposure even after the most visible systems have been patched.

Accurate inventory is therefore part of the response itself. Organizations cannot confidently eliminate exposure if they do not know where the affected technology exists.

---

Operational Impact

The most important operational factor is CISA’s confirmation that both vulnerabilities are already being exploited. KEV inclusion establishes that these flaws have moved beyond theoretical risk and into demonstrated offensive use.

For Fortinet environments, the concern involves a path traversal weakness affecting multiple products. Depending on the implementation, path traversal vulnerabilities can expose files or resources that should remain outside the reach of an attacker. CISA has not specified the exact resources exposed by CVE-2025-61624, so organizations should avoid assigning impacts not established by the source.

For BeyondTrust Remote Support, the concern centers on authentication bypass by spoofing. Remote-support platforms can hold an elevated place within organizational trust architecture because they are specifically designed to provide access to other systems. A weakness affecting authentication can therefore create risk at the point where remote access is authorized.

CISA does not state that exploitation of either vulnerability automatically results in total administrative control, unrestricted access to internal networks, widespread data theft, or lateral movement. Those outcomes depend on technical conditions not provided in the October 16 alert. The confirmed active exploitation still warrants rapid remediation and assessment of systems that remained vulnerable before corrective action was completed.

---

Why KEV Status Matters

The Known Exploited Vulnerabilities Catalog is designed to help defenders prioritize vulnerabilities based on demonstrated exploitation rather than severity ratings alone. Organizations may track thousands of CVEs across endpoints, servers, security appliances, remote-access systems, cloud environments, and applications, which makes prioritization critical.

For a vulnerability to qualify for potential inclusion in CISA’s KEV Catalog, CISA states that it must have:

• A CVE identifier.
• Evidence of exploitation.
• Clear mitigation guidance.

CVE-2025-61624 and CVE-2026-102764 have therefore crossed the threshold from published vulnerability to confirmed exploited vulnerability.

That does not eliminate the need to evaluate product exposure, configuration, business importance, or surrounding controls. It does mean defenders have concrete evidence that attackers are already using the weakness rather than simply possessing the technical ability to do so.

KEV status should therefore influence remediation order, especially when the affected technology is publicly exposed, remotely accessible, or positioned inside critical security and administrative workflows.

---

Federal Response

The October 16 additions fall under Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk, which establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies.

BOD 26-04 reinforces the role of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically KEV-listed CVEs affecting publicly exposed assets when successful exploitation can provide total control of the affected asset. The directive also permits lower-risk vulnerabilities to receive deferred action when they do not meet the same operational threshold.

The directive extends beyond patching by establishing basic expectations for determining when agencies must assess whether threat actors compromised a system before remediation occurred. That requirement is important because closing a vulnerability prevents future exploitation of the corrected weakness but does not determine whether an attacker used it before the fix was applied.

For vulnerabilities already under active exploitation, remediation and compromise assessment should therefore be treated as connected parts of the response process. CISA also encourages organizations outside the federal government to adopt risk-based vulnerability management and prioritize KEV-listed vulnerabilities.

---

Defensive Guidance

Organizations operating Fortinet products or BeyondTrust Remote Support should begin by identifying all potentially affected deployments and matching exact product versions and configurations against the applicable vendor remediation guidance.

Priority actions should include:

• Inventory all Fortinet products potentially covered by CVE-2025-61624.
• Identify every BeyondTrust Remote Support deployment.
• Record product versions, builds, roles, network locations, and external exposure.
• Determine whether affected management or service interfaces are reachable from untrusted networks.
• Apply supported security updates or vendor mitigations to vulnerable systems.
• Prioritize internet-facing or remotely accessible systems.
• Verify that remediation was successfully applied rather than relying only on scheduled patch completion.
• Review secondary, failover, disaster-recovery, test, and legacy deployments.
• Restrict administrative interfaces to authorized users and trusted network locations wherever practical.
• Preserve relevant security logs and system evidence when suspicious activity is identified.
• Review privileged accounts, remote sessions, configuration changes, and administrative activity during the exposure period.

Organizations should also assess the operational role of the affected systems. A vulnerable security product may influence traffic or network controls, while a remote-support platform may provide a pathway into other systems. Remediation priority should therefore account for both CISA’s active-exploitation designation and the level of trust assigned to the affected asset.

---

Compromise Assessment

Because CISA has confirmed active exploitation, affected organizations should consider whether vulnerable systems may have been accessed before remediation. The October 16 alert does not provide vulnerability-specific indicators of compromise, so general suspicious behaviors should not be presented as confirmed evidence tied directly to either CVE.

Defenders can review:

• Unexplained or unauthorized administrative logins.
• New accounts or unexpected privilege changes.
• Access from unfamiliar source addresses.
• Configuration changes outside approved maintenance activity.
• Unexpected file access or changes.
• Abnormal remote-support sessions.
• Unusual outbound network connections.
• Unexpected processes or command execution.
• Changes to security settings or access controls.
• Gaps, clearing, or unexplained changes in administrative and security logs.

For Fortinet environments, defenders should pay particular attention to unexpected file access, configuration changes, administrative activity, and network behavior occurring while systems remained vulnerable. The exact artifacts associated with CVE-2025-61624 should remain tied to Fortinet’s applicable technical guidance rather than generalized from the path traversal classification.

For BeyondTrust Remote Support, administrators should examine authentication records, remote sessions, account activity, administrator actions, source addresses, and configuration changes that do not align with expected operational use. Since CISA identifies CVE-2026-102764 as an authentication bypass by spoofing vulnerability, organizations should give particular attention to activity that appears to have been authorized without a clear legitimate authentication path.

If suspicious activity is identified, the response should expand beyond patching. Organizations may need to preserve forensic evidence, rotate credentials, revoke active sessions, inspect connected systems, review privileged access, and determine whether persistence or lateral movement occurred.

---

30-Day Outlook

The immediate 30-day response period should focus on locating vulnerable systems, applying remediation, validating the results, and assessing systems that remained exposed before corrective action.

Organizations should expect the following areas to remain important:

• Continued identification of Fortinet products potentially affected by CVE-2025-61624.
• Accelerated remediation of BeyondTrust Remote Support environments affected by CVE-2026-102764.
• Increased scrutiny of internet-facing or remotely accessible deployments.
• Review of historical authentication, administrative, and remote-session activity.
• Additional compromise assessments where systems remained vulnerable during the active exploitation period.
• Continued attention to secondary, legacy, failover, and disaster-recovery systems.
• Further vendor technical guidance clarifying affected versions, mitigations, or investigation requirements.

The most serious remaining exposure may exist in systems that are missed during the first remediation cycle. A primary appliance can be corrected while a secondary node remains vulnerable, and a central remote-support deployment can be secured while a separate environment remains exposed.

Organizations should verify remediation through a complete asset review rather than relying solely on the status of the most visible systems.

---

TRJ Verdict

CISA’s October 16 addition of CVE-2025-61624 and CVE-2026-102764 places two vulnerabilities affecting security and remote-access technologies into confirmed active exploitation status.

The Fortinet vulnerability involves path traversal across multiple products, while the BeyondTrust Remote Support vulnerability involves authentication bypass by spoofing. The vulnerabilities affect different technologies and security mechanisms, and CISA has not identified a shared threat actor or stated that they belong to the same campaign.

Their common factor is operational importance. Fortinet products can occupy trusted positions within network-security architecture, while BeyondTrust Remote Support can provide controlled access to systems across an organization. Weaknesses affecting those types of products deserve rapid attention because the technology itself may hold access or visibility that attackers could find valuable.

Organizations should identify affected deployments, apply applicable vendor remediation, confirm that corrective actions were successfully completed, and review systems that remained vulnerable during the exploitation period for evidence of unauthorized activity. Federal agencies must follow the risk-based requirements established under BOD 26-04, while organizations outside the federal government have the same practical reason to prioritize KEV-listed flaws.

The October 16 alert reinforces a fundamental cybersecurity requirement: products trusted to secure networks or provide remote access must be defended with the same rigor expected of the systems they protect. Once active exploitation is confirmed, remediation cannot remain a routine maintenance task.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---