Government Advisory

CISA Flags Active Attacks on Fortinet and BeyondTrust Products

CISA · 16 Oct 2026

Key Takeaway Check whether your business uses Fortinet or BeyondTrust Remote Support, apply the vendor's updates as a priority, and use the KEV Catalog to decide which patches to do first.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence that attackers are already using them. The first is CVE-2025-61624, a path traversal vulnerability affecting multiple Fortinet products. The second is CVE-2026-102764, an authentication bypass by spoofing vulnerability in BeyondTrust Remote Support.

CISA notes that these types of vulnerabilities are a frequent attack vector for malicious cyber actors. The agency's Binding Operational Directive (BOD) 26-04 requires US federal civilian agencies to prioritise rapid fixes for KEV-listed flaws on publicly exposed assets that give an attacker total control once exploited. It also sets expectations for checking whether a system was compromised before a patch was applied.

The directive applies only to federal agencies, but CISA encourages all organisations to adopt risk-based vulnerability management and to prioritise remediation of KEV Catalog vulnerabilities. Fortinet products and remote support tools are widely used, so Australian businesses running them should check whether they are affected.

Summarised by CISO AI from CISA, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.