U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Fortinet and BeyondTrust flaws to KEV, with a federal fix deadline of October 19.
CISA added Fortinet path-traversal flaw CVE-2025-61624 and BeyondTrust Remote Support authentication-bypass flaw CVE-2026-102764 to its Known Exploited Vulnerabilities catalog. Federal civilian agencies must fix them by October 19, 2026. Palo Alto Networks researchers said PEERSTITCH exploited the FortiOS auto-script flaw to expose more than 500 firewalls. CISA says attackers are using CVE-2026-102764, affecting Remote Support 26.2.3 and earlier, for initial access, persistence, privilege escalation, and lateral movement.
- CISA added both flaws to the KEV catalog.
- Federal agencies must remediate by October 19, 2026.
- PEERSTITCH abused Fortinet path traversal against 500-plus firewalls.
- BeyondTrust flaw enables access, persistence, escalation, and lateral movement.
- CVEs
- CVE-2025-61624CVE-2026-102764CVE-2026-1731CVE-2023-46805CVE-2024-21887CVE-2025-0282CVE-2023-4966
- Products
- FortiOSFortiManagerBeyondTrust Remote SupportPrivileged Remote AccessBomgarCitrix NetScalerIvanti Connect Secure
- Organizations
- CISAPalo Alto NetworksMandiantBeyondTrustGoogle Threat Intelligence GroupGoogleCrowdStrikeGoogle CloudCanadian Centre for Cyber Security
- Countries
- United StatesChinaCanada
Coverage
oldest first · one row per article · UTC- · 14d ago
The Hacker NewsFirst report
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 to seize support appliances.
- · 14d ago
Cyber Security News
Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors
China-linked ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 for root access and persistent backdoors.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-21887+1 related CVE | Command Injection RCE in Ivanti Connect Secure and Policy Secure | 9.1 group max | 100% | KEVRansomwarePoC | KEV |
| CVE-2023-4966 | Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway | 7.5 | 100% | KEVRansomware | KEV |
| CVE-2025-0282 | Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways | 9.0 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2025-61624 | Authenticated path traversal in Fortinet FortiOS and related products | 6.5 | 1% | KEV | KEV |
| CVE-2026-102764 | Message-origin spoofing enables file ops on BeyondTrust Remote Support | 9.3 | 19% | KEVPoC ×2 | KEV |
| CVE-2026-1731 | Pre-Authentication OS Command Injection RCE in BeyondTrust Remote Support and PRA | 9.9 | 93% | KEVRansomwarePoC | KEV |