CISA KEV adds exploited Fortinet and BeyondTrust flaws as PEERSTITCH targets FortiOS

CISA KEV adds exploited Fortinet CVE-2025-61624 and BeyondTrust CVE-2026-102764; PEERSTITCH malware, F5/Juniper patches, and school lessons.

CISA added CVE-2025-61624 (Fortinet path traversal) and CVE-2026-102764 (BeyondTrust Remote Support auth bypass by spoofing) to its KEV catalog on evidence of active exploitation.
Reporting links CVE-2025-61624 to PEERSTITCH, memory-resident ARM64 malware on FortiOS; F5/Juniper also patched critical flaws and Magento/Adobe Commerce has a maximum-severity BlockStrap bug.
K-12 and government edge devices—VPN, firewall, remote support—are exposed; prioritize inventory, emergency patching, MFA, segmentation and log hunting.

What to do now

Inventory every internet-facing Fortinet, BeyondTrust Remote Support, F5 and Juniper device, including third-party-managed systems; record version, owner, exposure and management access.
Apply vendor patches or mitigations for the two KEV CVEs first under an emergency change, then F5/Juniper critical fixes; if patching is not possible, restrict access by IP allowlist/VPN and document the exception.
Hunt logs for path traversal, authentication bypass/spoofing, new admin accounts, configuration changes, tagged VPN session anomalies and unusual outbound traffic; preserve volatile memory before rebooting suspected PEERSTITCH hosts.
Enforce MFA and least privilege on VPN, remote support and device management; rotate credentials and secrets if compromise is suspected; segment management planes from user and internet networks.
Verify offline immutable backups and restoration; brief incident response, report suspected compromise to CISA/vendor and internal IR, and track vendor advisories daily until patched.