As reported by SecurityAffairs on October 17, 2026, CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog — one affecting multiple Fortinet products and another targeting BeyondTrust Remote Support. Both flaws are being leveraged by threat actors for initial access, persistence, and lateral movement, making them urgent priorities well beyond the federal agency compliance deadline of October 19, 2026.
Vulnerability Summary
| CVE | Product | Type | Severity | Patch Available | Active Exploitation |
|---|---|---|---|---|---|
| CVE-2025-61624 | Fortinet Multiple Products (FortiManager / FortiOS auto-script engine) | Path Traversal | Critical | Yes — vendor advisory available | Yes — PEERSTITCH malware deployment reported |
| CVE-2026-102764 | BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier | Authentication Bypass by Spoofing | Critical | Yes — patches for supported versions (24.3.1+); older versions require upgrade first | Yes — attackers gaining initial access, escalating privileges, moving laterally |
Why This Matters
The Fortinet flaw is particularly significant because it has been weaponized as part of a coordinated campaign involving PEERSTITCH malware, which Palo Alto Networks researchers linked to the exposure of over 500 firewalls. This is not opportunistic scanning — it is a targeted operation against infrastructure that organizations depend on for perimeter defense. When the device managing your security posture becomes the entry point, the blast radius extends to every asset it governs.
The BeyondTrust vulnerability is equally concerning for a different reason: remote support tools are designed to provide privileged, interactive access to endpoints. An authentication bypass in such a platform effectively hands attackers the same capabilities as a trusted help desk technician. The advisory confirms that actors are using this access to establish persistence and move laterally — the classic playbook for post-compromise escalation leading to data theft or ransomware deployment.
Who Is Most at Risk
Shield53 Recommendations
Immediate Actions
- Patch Fortinet products immediately. Apply the vendor fix for CVE-2025-61624 across all FortiManager and FortiOS deployments. Prioritize management-plane infrastructure first.
- Upgrade and patch BeyondTrust Remote Support. If you are on a supported version (24.3.1 or later), apply the patch now. If you are on an older, unsupported version, initiate an upgrade immediately and implement compensating controls in the interim.
- Restrict management-plane access. Ensure FortiManager and BeyondTrust administrative interfaces are not exposed to the public internet. Enforce VPN or allowlist-based access controls.
- Hunt for PEERSTITCH indicators. Review FortiManager logs for unauthorized auto-script executions, unexpected configuration changes, or anomalous administrative sessions. Examine FortiOS memory for persistence artifacts as described in the Palo Alto Networks research.
- Audit BeyondTrust session logs. Look for sessions originating from unexpected IP ranges, sessions outside business hours, or file operations that do not correlate with legitimate support tickets.
- Isolate suspected compromises. If indicators are found, treat the affected management infrastructure as potentially fully compromised. Rebuild from known-good images rather than attempting in-place remediation.
Detection Guidance
- Monitor for path traversal patterns targeting FortiOS auto-script endpoints (e.g.,
../sequences in HTTP requests to management interfaces). - Alert on BeyondTrust authentication events that bypass normal credential validation flows or originate from spoofed internal components.
- Correlate FortiManager configuration push events with authorized change tickets — unticketed configuration changes are a high-fidelity indicator of compromise.
The common thread across both vulnerabilities is that they target management infrastructure — the systems defenders trust to secure everything else. Compromise at this layer invalidates downstream trust assumptions. Treat both as active incidents, not routine patching.
Organizations that delay remediation past the CISA deadline are accepting material risk. Both vulnerabilities are confirmed to be under active exploitation, and public reporting on the PEERSTITCH campaign increases the likelihood of copycat activity. The window between disclosure and broad exploitation has already closed.
