[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPrBoQUfCR1lqB1wxO7j0bTK1yjxAQS-msyR62567YvU":3},{"article":4,"iocs":53,"watch_terms":61,"solutions":62,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":35},"bc28aec3-0333-4efc-865d-716ae728b924","CISA Adds Two Known Exploited Vulnerabilities to Catalog","cisa-adds-two-known-exploited-vulnerabilities-to-catalog-ae4608","CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.","CISA has added two new vulnerabilities, CVE-2025-61624 and CVE-2026-102764, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These vulnerabilities, affecting Fortinet products and BeyondTrust Remote Support respectively, are frequently used by malicious actors. CISA's Binding Operational Directive (BOD) 26-04 mandates federal agencies to prioritize the remediation of these high-risk vulnerabilities on publicly exposed assets.","CISA adds two actively exploited vulnerabilities to its KEV Catalog, urging federal agencies to prioritize patching.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F10\u002F16\u002Fcisa-adds-two-known-exploited-vulnerabilities-catalog",null,"2026-10-16T12:00:00+00:00","2026-10-16T20:00:11.767226+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Fortinet","vendor",{"name":21,"type":22},"Remote Support","product",{"name":24,"type":19},"BeyondTrust",{"name":26,"type":22},"KEV Catalog",{"name":28,"type":22},"Binding Operational Directive (BOD) 26-04",{"name":30,"type":19},"CISA","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":12,"name":33,"slug":34},"Vulnerabilities","vulnerabilities",[36,41,43,48],{"category":37},{"id":38,"icon":12,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":31,"icon":12,"name":33,"slug":34},{"category":44},{"id":45,"icon":12,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":49},{"id":50,"icon":12,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58],{"type":55,"value":56,"context":57},"cve","CVE-2025-61624","Fortinet Multiple Products Path Traversal Vulnerability",{"type":55,"value":59,"context":60},"CVE-2026-102764","BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability",[18,24,30],{"controls":63,"vendors":146},[64,93,118],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":94,"name":95,"problem":96,"products":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",[98,102,110],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":94,"product_name":99,"url":100,"description":101},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":119,"name":120,"problem":121,"products":122},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":141,"url":144,"description":145},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",[147,152],{"slug":148,"name":24,"logo_path":149,"roles":150},"beyondtrust","\u002Fvendor-logos\u002Fbeyondtrust.png",[151],"affected",{"slug":153,"name":18,"logo_path":154,"roles":155},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[151],{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":169},"active-exploitation-of-fortinet-and-beyondtrust-flaws-highlights-patch-urgency","Active Exploitation of Fortinet and BeyondTrust Flaws Highlights Patch Urgency","CISA's addition of CVE-2025-61624 and CVE-2026-102764 to the Known Exploited Vulnerabilities Catalog confirms that threat actors are actively exploiting unpatched flaws in Fortinet products and BeyondTrust Remote Support — two widely deployed enterprise tools. The root cause is a failure to apply vendor patches promptly, leaving publicly exposed assets as easy targets for malicious actors. BeyondTrust and Fortinet products are high-value targets because they often hold privileged access to internal networks, meaning a successful exploit can serve as a launchpad for lateral movement or data exfiltration. Federal agencies are legally obligated under BOD 26-04 to remediate these vulnerabilities, but the broader private sector should treat the KEV Catalog as an urgent, actionable threat intelligence feed rather than a government-only concern.",[161,162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","CISA BOD 26-04: Reducing the Significant Risk of Known Exploited Vulnerabilities","ITIL Change Management: Emergency Change Procedures","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning",{}]