CISA Adds Two Known Exploited Vulnerabilities to Catalog

CVE-2025-61624 is a path traversal flaw (CWE-22) in multiple Fortinet products that fails to keep a pathname inside a restricted directory. An attacker who is already authenticated with an administrator profile and at least read-write permissions can use specific CLI commands to write or delete arbitrary files. The impact is high integrity and availability loss with no confidentiality impact scored (CVSS 3.1 base 6.5); it is not an unauthenticated remote code execution bug. Affected products are FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager in the version ranges listed by Fortinet. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-16, so exploitation in the wild is confirmed, while ransomware use is listed as unknown and no public proof-of-concept is known; related reporting describes stealthy FortiGate implants but does not by itself identify this CVE as the sole intrusion path.

Do: Apply Fortinet's fixes or mitigations for every listed FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager release, following CISA BOD 26-04; do not treat a specific build as safe unless the vendor advisory names it. Limit CLI access to trusted administrators with read-write profiles, and review admin accounts and logs for unexpected file writes or deletions. Because this CVE is in CISA's KEV catalog, also follow CISA's forensics triage guidance and discontinue use if a mitigation is unavailable.

CVE-2026-102764 is a critical (CVSS 4.0 9.3) authentication-bypass-by-spoofing flaw (CWE-290) in internal components of BeyondTrust Remote Support. Those components do not adequately check the origin of messages they receive, so a remote attacker can, under the right conditions, send spoofed messages over the network with no privileges and no user interaction. Successful exploitation can allow file operations on the appliance, with high impact to confidentiality, integrity, and availability of the vulnerable system and no stated impact on other systems. The provided data identifies BeyondTrust Remote Support but does not name affected version ranges. No public proof of concept is known and the CVE is not listed in CISA KEV; a related headline refers to “ARMORY CASTLE” exploiting BeyondTrust, but that report is not confirmed by the structured advisory data.

Do: Keep BeyondTrust Remote Support appliances off untrusted networks and allow management and support traffic only from trusted sources. Apply the vendor patch or hotfix for this issue as soon as BeyondTrust publishes it for your build, and review appliance logs for unexpected file operations or messages from untrusted origins. No fixed version is named in the provided data, so confirm the corrected release directly with BeyondTrust.