U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog

U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog

Pierluigi Paganini
October 17, 2026

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability
• CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability 

This week, Palo Alto Netwoks researchers reported that PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, evade detection inside FortiOS memory, and maintain stealthy access.

The attackers exploited CVE-2025-61624, a path traversal flaw in the FortiOS auto-script engine, to deploy a new implant called PEERSTITCH.

The flaw CVE-2026-102764 is an input validation vulnerability in internal components of BeyondTrust Remote Support. BeyondTrust Remote Support is a remote technical support tool that allows IT help desks and support teams to securely access and troubleshoot users’ computers and other devices over a network. From a cybersecurity perspective, the software is important because it can provide privileged access to systems and allow technicians to perform sensitive operations.

The components do not properly validate the origin of incoming messages, potentially allowing an attacker to perform file operations on the appliance under certain conditions.

“CISA is aware of critical authentication bypass vulnerability CVE-2026-102764
, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first.” CISA warns. “Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. “

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by October 19, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts