CISA added actively exploited Fortinet and BeyondTrust flaws to KEV, with a federal fix deadline of October 19.
CISA added Fortinet path-traversal flaw CVE-2025-61624 and BeyondTrust Remote Support authentication-bypass flaw CVE-2026-102764 to its Known Exploited Vulnerabilities catalog. Federal civilian agencies must fix them by October 19, 2026. Palo Alto Networks researchers said PEERSTITCH exploited the FortiOS auto-script flaw to expose more than 500 firewalls. CISA says attackers are using CVE-2026-102764, affecting Remote Support 26.2.3 and earlier, for initial access, persistence, privilege escalation, and lateral movement.
CISA added both flaws to the KEV catalog.
Federal agencies must remediate by October 19, 2026.
PEERSTITCH abused Fortinet path traversal against 500-plus firewalls.
BeyondTrust flaw enables access, persistence, escalation, and lateral movement.
Command Injection RCE in Ivanti Connect Secure and Policy Secure
Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure appliances contain a command injection flaw (CWE-77) in their web components, triggered when an authenticated administrator sends crafted requests to the appliance. The bug can be chained with the separate authentication bypass CVE-2023-46805, allowing an unauthenticated attacker to achieve the same result. Successful exploitation lets an attacker execute arbitrary commands and code on the appliance, providing a foothold into the networks behind the VPN or network access control gateway. Any organization running these appliances, typically enterprises and government agencies often deployed directly on the internet perimeter, is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-10 with known ransomware use and EPSS assigns a 100% probability of exploitation within 30 days, although no public proof-of-concept is available.
Do: Apply Ivanti's mitigations or patched builds immediately per vendor instructions, addressing the chained authentication bypass CVE-2023-46805 at the same time, and discontinue or restrict use of any appliance for which mitigations are unavailable, especially if it is internet-facing. Because exploitation with ransomware use is known, assume compromise is possible: review appliance web logs for suspicious requests and run Ivanti's integrity-checking guidance to verify appliance images before and after remediation. Where feasible, restrict direct internet exposure of the appliance web interface and monitor for further vendor advisories.
Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway
Citrix NetScaler ADC and NetScaler Gateway appliances contain a buffer overflow (CWE-119) that leaks sensitive information from device memory when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. A remote attacker who can reach such a configuration can trigger the overflow and read memory contents, harvesting sensitive data such as session tokens (a technique that enables session hijacking which can bypass multi-factor authentication). Any organization running an affected NetScaler ADC or Gateway appliance in these configurations is exposed, with appliances deployed as VPN or access gateways being the primary concern. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2023-10-18 with known ransomware use and a 100% EPSS exploitation probability, although no public proof-of-concept is known at this time. Because tokens stolen from memory can remain valid even after patching, responders must terminate all active and persistent sessions as part of remediation.
Do: Upgrade affected appliances to the patched builds cited in Citrix's advisory, then immediately kill all active and persistent ICA/AAA sessions per the vendor instructions, since patching alone does not invalidate session tokens attackers may have already stolen. If patching is not immediately possible, discontinue use of the affected Gateway/AAA configurations as CISA directs. Given known ransomware abuse, also hunt for signs of exploitation such as logins from unexpected sources, anomalous session reuse, or suspicious mailbox changes, and reset credentials for potentially exposed accounts.
Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways
CVE-2025-0282 is a stack-based buffer overflow (CWE-121) in Ivanti Connect Secure, Policy Secure, and ZTA Gateways, reachable by unauthenticated network input. An attacker can trigger it remotely by sending crafted, unauthenticated traffic to a vulnerable gateway, overwriting stack memory and gaining code execution under the appliance's context. Successful exploitation yields unauthenticated remote code execution on the device, giving the attacker control of the VPN/secure-access gateway and a foothold into the protected network. Organizations running any of the affected Ivanti secure-access products are exposed; the source data specifies no version ranges, so defenders should consult Ivanti's advisory for exact affected and fixed releases. The flaw is being actively exploited: it was added to CISA KEV on 2025-01-08 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days (100th percentile), despite no public PoC being known.
Do: Apply the patched releases identified in Ivanti's advisory and follow CISA's required action: hunt for signs of compromise, remediate if indicators are found, and apply updates before returning any device to service. Because exploitation is active and ransomware use is known, treat any appliance that was internet-reachable before patching as potentially compromised (check integrity, rotate credentials). Exact fixed versions were not included in the source data, so verify the correct update path for your branch (including older Connect Secure/Policy Secure releases) against Ivanti's bulletin.
Authenticated path traversal in Fortinet FortiOS and related products
CVE-2025-61624 is a path traversal flaw (CWE-22) in multiple Fortinet products that fails to keep a pathname inside a restricted directory. An attacker who is already authenticated with an administrator profile and at least read-write permissions can use specific CLI commands to write or delete arbitrary files. The impact is high integrity and availability loss with no confidentiality impact scored (CVSS 3.1 base 6.5); it is not an unauthenticated remote code execution bug. Affected products are FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager in the version ranges listed by Fortinet. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-16, so exploitation in the wild is confirmed, while ransomware use is listed as unknown and no public proof-of-concept is known; related reporting describes stealthy FortiGate implants but does not by itself identify this CVE as the sole intrusion path.
Do: Apply Fortinet's fixes or mitigations for every listed FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager release, following CISA BOD 26-04; do not treat a specific build as safe unless the vendor advisory names it. Limit CLI access to trusted administrators with read-write profiles, and review admin accounts and logs for unexpected file writes or deletions. Because this CVE is in CISA's KEV catalog, also follow CISA's forensics triage guidance and discontinue use if a mitigation is unavailable.
6.5
1%
KEV
Fortinet FortiOS 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2 all versions, 7.0 all versions, 6.4 all versions
Message-origin spoofing enables file ops on BeyondTrust Remote Support
CVE-2026-102764 is a critical (CVSS 4.0 9.3) authentication-bypass-by-spoofing flaw (CWE-290) in internal components of BeyondTrust Remote Support. Those components do not adequately check the origin of messages they receive, so a remote attacker can, under the right conditions, send spoofed messages over the network with no privileges and no user interaction. Successful exploitation can allow file operations on the appliance, with high impact to confidentiality, integrity, and availability of the vulnerable system and no stated impact on other systems. The provided data identifies BeyondTrust Remote Support but does not name affected version ranges. No public proof of concept is known and the CVE is not listed in CISA KEV; a related headline refers to “ARMORY CASTLE” exploiting BeyondTrust, but that report is not confirmed by the structured advisory data.
Do: Keep BeyondTrust Remote Support appliances off untrusted networks and allow management and support traffic only from trusted sources. Apply the vendor patch or hotfix for this issue as soon as BeyondTrust publishes it for your build, and review appliance logs for unexpected file operations or messages from untrusted origins. No fixed version is named in the provided data, so confirm the corrected release directly with BeyondTrust.
Pre-Authentication OS Command Injection RCE in BeyondTrust Remote Support and PRA
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical (CVSS 4.0: 9.9) pre-authentication operating system command injection vulnerability (CWE-78). By sending specially crafted requests to the appliance, an unauthenticated remote attacker can execute operating system commands in the context of the site user, gaining code execution without credentials or user interaction. Any organization running RS or PRA appliances that are reachable from the internet, which is their typical deployment mode for remote support and privileged access, is affected. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-13 with known ransomware use, carries an EPSS of 89.5% (100th percentile), has a public proof-of-concept, and press coverage links the newly patched BeyondTrust RCE to fast-moving ransomware activity (Storm-1175). BeyondTrust has released fixes, so unpatched, internet-exposed instances should be treated as high-priority compromise targets.
Do: Upgrade all internet-exposed Remote Support and Privileged Remote Access appliances to the fixed releases in BeyondTrust's security advisory immediately, per the CISA KEV required action (apply vendor mitigations or discontinue use if mitigation is unavailable). Until patched, restrict network access to the appliance and review appliance/web logs for suspicious unauthenticated requests, given known ransomware exploitation and the availability of a public proof-of-concept.
Stories merge articles from different outlets about the same event. The summary is rewritten by the model whenever new coverage arrives; individual articles keep their own summaries and full text.
Citrix NetScaler ADC and NetScaler Gateway
masshundreds of thousands of internet-exposed NetScaler ADC/Gateway appliances (public internet scan counts), plus an unknown number of VPN-only or internal…
KEV
PoC ×3
Ivanti Connect Secure
Ivanti Policy Secure
Ivanti ZTA Gateways
largetens of thousands of internet-exposed appliances (likely 100,000+ total deployments including internal-only gateways)
KEV
Fortinet FortiPAM 1.7.0, 1.6 all versions, 1.5 all versions, 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions
Fortinet FortiProxy 7.6.0 through 7.6.4, 7.4.0 through 7.4.11, 7.2 all versions, 7.0 all versions
+1 more
largeon the order of 10,000–100,000+ Fortinet appliances potentially in affected ranges
KEV
—
KEV
PoC
BeyondTrust Remote Support (RS)
BeyondTrust Privileged Remote Access (PRA) Certain older versions (per the CVE description); exact affected and fixed ranges per BeyondTrust's advisory
largeon the order of tens of thousands of internet-exposed RS/PRA appliance instances worldwide
GBHackers· 84
The Hacker News· 86
Cyber Security News· 86