CISA KEV flags exploited Fortinet and BeyondTrust flaws as ConnectWise breach reportedly hits 173 M365 tenants

CISA KEV adds exploited Fortinet and BeyondTrust flaws; ConnectWise Cloud Backup breach reportedly affects 173 M365 tenants. K-12 actions.

CISA added Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild.
ConnectWise suspended Cloud Backup access after attackers used application identities to reach Microsoft 365 tenants; one report cites 173 tenants.
K-12 impact: internet-facing firewalls, remote-support tools, and third-party backup apps are trust paths into district email, files, and identity data.

What to do now

Inventory now: list every FortiManager, Fortinet edge device, BeyondTrust Remote Support appliance, and Microsoft Entra ID app registration or enterprise app linked to ConnectWise Cloud Backup or SkyKick; record owner, version, internet exposure, and permissions.
Remove public management access and patch: close inbound admin interfaces to the internet, then apply Fortinet and BeyondTrust fixes and mitigations from the vendor advisories; confirm the exact CVE IDs in CISA KEV before closing the ticket.
Contain the ConnectWise identity path: disable or revoke consent for non-essential ConnectWise or SkyKick app identities, revoke active refresh tokens and sessions, rotate client secrets and certificates, and pause reliance on the suspended backup service until vendor confirmation.
Hunt and preserve: review Entra sign-in and unified audit logs for new consent grants, mailbox rule changes, role assignments, impossible travel, and mass file access; export logs before remediation.
Harden and escalate: enforce phishing-resistant MFA and conditional access for admins, apply least privilege to third-party apps, segment management planes, and report suspected tenant or firewall compromise through incident response and to ConnectWise or Microsoft.