CISA Adds Fortinet and BeyondTrust Flaws to Known Exploited Vulnerabilities Catalog
Federal agencies must remediate critical path traversal and authentication bypass vulnerabilities by October 2026.
1CISA Updates KEV Catalog
The Cybersecurity and Infrastructure Security Agency has officially added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog. These include a path traversal flaw in Fortinet products and an authentication bypass vulnerability in BeyondTrust Remote Support. Federal agencies are now mandated to address these specific security gaps to protect their infrastructure.
2Fortinet Path Traversal Risks
The vulnerability CVE-2025-61624 affects the FortiOS auto-script engine, allowing attackers to perform path traversal operations. Palo Alto Networks researchers identified that this flaw facilitates the deployment of the PEERSTITCH malware. This malicious implant has already been used to compromise over 500 firewalls while evading detection within the FortiOS memory environment.
3BeyondTrust Authentication Bypass
CVE-2026-102764 is an input validation vulnerability found in internal components of BeyondTrust Remote Support, formerly known as Bomgar. The flaw stems from improper validation of incoming message origins. This allows unauthorized actors to perform file operations on the appliance, potentially leading to full system compromise under specific conditions during remote support sessions.
4Impact on Remote Support
BeyondTrust Remote Support is a critical tool for IT help desks, providing privileged access to troubleshoot user devices. Because this software enables sensitive operations, the authentication bypass flaw poses a severe risk. Attackers are currently leveraging this vulnerability to gain initial access, establish persistence, escalate privileges, and move laterally across internal networks.
5Mandatory Remediation Timeline
Under the Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies are required to remediate these identified vulnerabilities. CISA has set a strict deadline of October 19, 2026, for these organizations to apply necessary patches. This directive aims to reduce the significant risk posed by vulnerabilities currently being exploited by malicious actors.
6Patching Guidance for Users
CISA confirms that the authentication bypass vulnerability affects BeyondTrust Remote Support versions 26.2.3 and earlier. Patches are currently available for supported versions starting from 24.3.1 and later. Organizations running older, unsupported versions of the software must prioritize upgrading their systems to a supported version before applying the necessary security patches to mitigate risks.
7Broader Security Implications
The active exploitation of these vulnerabilities highlights the ongoing threat to enterprise-grade networking and support tools. By targeting the auto-script engine in Fortinet and input validation in BeyondTrust, attackers demonstrate a sophisticated understanding of internal appliance components. These incidents underscore the necessity of continuous monitoring and rapid patch management for all critical infrastructure.
8Recommendations for Private Sector
While the directive specifically targets federal agencies, experts strongly advise private organizations to review the CISA KEV catalog regularly. Proactive identification and remediation of these flaws are essential to prevent similar exploitation within private networks. Maintaining updated software and monitoring for anomalous behavior remains the most effective defense against these evolving cyber threats.