CISA has confirmed that attackers are exploiting two more security flaws, one in Fortinet's firewall and proxy software and one in BeyondTrust's Remote Support appliance, and added both to its Known Exploited Vulnerabilities (KEV) catalog on October 16. A KEV listing means the agency has evidence of real-world attacks, and it starts a remediation clock for US federal civilian agencies.
The two bugs sit at opposite ends of the severity scale. The BeyondTrust flaw is rated critical and was disclosed only a day earlier. The Fortinet flaw is a medium-severity bug whose CVE record dates to April and which had no public exploitation listing until now.
BeyondTrust's zero-day gets an official exploited tag
The more severe entry is CVE-2026-102764, which NVD scores 9.3. CISA lists it as a BeyondTrust Remote Support authentication bypass by spoofing. According to the NVD record, internal components of the product did not adequately validate the origin of the messages they received, which under the right conditions could let an attacker perform file operations on the appliance.
The KEV addition formalizes what Google Threat Intelligence Group and Mandiant had already reported: a suspected Chinese espionage crew exploited the flaw as a zero-day starting in late August, weeks before BeyondTrust disclosed it on October 15. We covered that intrusion, including the SAWFLY webshell and the actor Google now tracks as ARMORY CASTLE (previously UNC5221), in our earlier report. CISA's alert itself does not name an actor.
An April Fortinet bug is now under attack
The second entry, CVE-2025-61624, is listed by CISA as a Fortinet multiple products path traversal vulnerability. NVD scores it 6.0. Per the NVD description, it may allow an authenticated attacker with an admin profile and at least read-write permissions to write or delete arbitrary files through specific CLI commands. That precondition, privileged administrative access to the device, is why the score is moderate.
Its reach is wide. NVD lists affected versions as FortiOS 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, and all versions of 7.2, 7.0 and 6.4; FortiProxy 7.6.0 through 7.6.4, 7.4.0 through 7.4.11, and all versions of 7.2 and 7.0; FortiPAM 1.0 through 1.7.0; and FortiSwitchManager 7.2.0 through 7.2.7 and 7.0.0 through 7.0.6. The CVE record was published on April 14, 2026.
Neither CISA nor NVD says how the Fortinet flaw is being used in the wild, and CISA has not marked either entry as known to be used in ransomware campaigns. Fortinet's own PSIRT advisory carries the fixed-version detail.
Patch both, then look for earlier compromise
Federal civilian agencies must remediate both flaws under Binding Operational Directive 26-04, which CISA says also sets expectations for checking whether threat actors compromised a system before the patch was applied. CISA urges every organization to prioritize KEV entries.
- BeyondTrust Remote Support: upgrade per BeyondTrust's advisory (all supported versions up to 26.2.3 are affected), and because exploitation began weeks before disclosure, hunt for signs of compromise going back to late August.
- Fortinet FortiOS, FortiProxy, FortiPAM and FortiSwitchManager: move to a fixed release listed in Fortinet's PSIRT advisory, and review which accounts hold read-write admin profiles, since that access is the stated precondition.
The KEV catalog has leaned heavily on edge and remote-access gear lately, following CISA's recent Cisco email gateway and PAN-OS additions. The BeyondTrust case is the reminder worth keeping: the KEV date marks when the public clock starts, not when the attacks did.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.