CISA's latest addition of two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog highlights an important cybersecurity concern: the very platforms organizations rely upon to secure and manage enterprise access are increasingly becoming attractive targets for attackers.

The newly listed vulnerabilities are CVE-2025-61624, a path traversal weakness affecting multiple Fortinet products, and CVE-2026-102764, an authentication bypass by spoofing vulnerability affecting BeyondTrust Remote Support.

Both vulnerabilities have been added to the catalog based on evidence of exploitation in real-world attacks.

What makes these vulnerabilities particularly concerning is the role of the affected technologies within enterprise infrastructure.

Security appliances and remote support platforms frequently occupy privileged positions in the network. They may provide access to sensitive configurations, administrative interfaces, authentication services or systems that support critical business operations.

If attackers compromise these platforms, the consequences can potentially extend beyond the original device or application.

Depending on the product, configuration and privileges available, a successful attack may create opportunities for unauthorized access, sensitive information exposure, persistence or movement toward other systems.

The Fortinet vulnerability involves path traversal, a weakness that can allow attackers to manipulate file paths and potentially access resources outside their intended locations.

The BeyondTrust vulnerability involves improper validation of message origins within internal application components, allowing an unauthenticated attacker to perform unauthorized file operations under vulnerable conditions.

Although the technical mechanisms differ, both incidents reinforce a common security principle: trusted infrastructure must not be exempt from continuous security verification.

Organizations often invest heavily in protecting business applications, endpoints and user identities. However, management interfaces, remote support systems and security appliances themselves must receive equally rigorous protection.

The addition of these vulnerabilities to CISA's KEV catalog changes the urgency of remediation.

These are no longer merely theoretical weaknesses that might be exploited in the future. CISA has identified evidence that attackers are already exploiting them.

Organizations should immediately identify affected deployments, apply the relevant vendor security updates and restrict unnecessary exposure of administrative interfaces.

Equally important, security teams should investigate whether vulnerable systems were compromised before remediation.

Applying a patch closes the known vulnerability, but it does not automatically remove unauthorized changes, stolen credentials or persistence mechanisms that may already exist.

The incident also reinforces the importance of maintaining independent monitoring and logging for security infrastructure, rather than relying exclusively on the compromised platform to report its own security status.

The broader lesson is that security products are part of an organization's attack surface, not exceptions to it.

Organizations must protect their security infrastructure with the same discipline, visibility and urgency that they apply to the systems those products are designed to defend.

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities . CISA will continue to add vulnerabilities to the catalog that meet the specified criteria . Aware of an exploited vulnerability not curren

Source: CISA Adds Two Known Exploited Vulnerabilities to Catalog via CISA Advisories — published 16 Oct 2026.