CISA Adds Fortinet Path Traversal and BeyondTrust Auth Bypass to KEV Catalog

What Happened

CISA expanded its Known Exploited Vulnerabilities (KEV) catalog with two CVEs that have documented active exploitation. The first, CVE‑2025‑61624, targets multiple Fortinet products and allows a path‑traversal attack that can lead to arbitrary file access. The second, CVE‑2026‑102764, affects BeyondTrust Remote Support and enables authentication bypass through spoofed credentials.

Impact

Both vulnerabilities can be leveraged to gain full control of publicly exposed systems. Attackers have already used them to compromise federal and commercial networks, making them high‑risk assets for any organization with exposed Fortinet or BeyondTrust services.

What to Do

• Check whether your environment runs affected Fortinet firmware or BeyondTrust Remote Support versions.
• Apply the latest vendor patches or configuration mitigations as soon as possible.
• Verify that exposed services are no longer reachable from the internet after remediation.
• Monitor logs for path‑traversal or authentication‑bypass indicators and investigate any anomalies.
• Consider submitting any other actively exploited CVEs to CISA’s KEV nomination form.

Federal agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets, per BOD 26‑04, and verify that threat actors have not already compromised systems before patching.