CISA Flags Two Actively Exploited Flaws in Fortinet and BeyondTrust

Key points

• Two CVEs (CVE-2025-61624, CVE-2026-102764) are being exploited in the wild.
• Affected products: Fortinet multiple products and BeyondTrust Remote Support.
• Impacts include path traversal, authentication bypass, spoofing, and full asset control.
• Federal agencies must prioritize remediation under BOD 26-04; lower-risk items can be deferred.

On October 16, 2026, the cybersecurity community was alerted to active exploitation of two vulnerabilities: CVE-2025-61624 and CVE-2026-102764. These flaws affect Fortinet's multiple products and BeyondTrust's Remote Support solution. Malicious actors are leveraging these issues, prompting their addition to the Known Exploited Vulnerabilities (KEV) catalog. This designation signals that the vulnerabilities pose a significant risk and require immediate attention.

The technical impact is severe. CVE-2025-61624 and CVE-2026-102764 enable path traversal, authentication bypass, and spoofing, which can lead to full asset control. In other words, an attacker could navigate directories, circumvent login mechanisms, impersonate legitimate users, and ultimately take complete control of affected systems. Such capabilities make these flaws highly attractive for initial access and lateral movement within networks.

The scope of concern extends to federal enterprise and FCEB agencies, as highlighted by the issuance of Binding Operational Directive 26-04. This directive mandates that federal civilian executive branch departments prioritize remediation of these CVEs. However, the risk is not limited to government entities; any organization using the affected Fortinet or BeyondTrust products should treat this as a high-priority event. The directive also allows for deferring lower-risk updates to focus resources on these critical fixes.

Why does this matter? These vulnerabilities are already being exploited, and the combination of authentication bypass and full asset control means attackers could gain persistent access, exfiltrate data, or disrupt operations. The KEV catalog inclusion and BOD 26-04 underscore the urgency. Organizations should act swiftly to patch or mitigate, as delays could lead to compromise.

What to watch: Monitor vendor advisories for patches and workarounds. Track exploitation attempts through logs and network monitoring. Expect further guidance or deadlines from CISA. Additionally, watch for any expansion of affected products or new CVEs related to these vendors. The situation is evolving, and proactive defense is essential.

What to do now

1. Immediately inventory all instances of Fortinet multiple products and BeyondTrust Remote Support across your environment.
2. Apply vendor-provided patches or mitigations as soon as they become available, prioritizing internet-facing and critical systems.
3. Follow BOD 26-04 deadlines: remediate these CVEs within the required timeframe, and defer lower-risk updates if necessary.
4. Monitor logs and network traffic for indicators of path traversal, authentication bypass, or spoofing attempts targeting these products.
5. Enforce network segmentation and least privilege to limit the blast radius if exploitation occurs.
6. Review and rotate credentials for affected systems, as authentication bypass could have exposed sensitive accounts.
7. Report any suspected compromise to CISA and your internal incident response team immediately.

CVE references

• CVE-2025-61624
• CVE-2026-102764

Original source

CISA Advisories