Active Exploitation of Fortinet and BeyondTrust Flaws Highlights Patch Urgency
CISA's addition of CVE-2025-61624 and CVE-2026-102764 to the Known Exploited Vulnerabilities Catalog confirms that threat actors are actively exploiting unpatched flaws in Fortinet products and BeyondTrust Remote Support — two widely deployed enterprise tools. The root cause is a failure to apply vendor patches promptly, leaving publicly exposed assets as easy targets for malicious actors. BeyondTrust and Fortinet products are high-value targets because they often hold privileged access to internal networks, meaning a successful exploit can serve as a launchpad for lateral movement or data exfiltration. Federal agencies are legally obligated under BOD 26-04 to remediate these vulnerabilities, but the broader private sector should treat the KEV Catalog as an urgent, actionable threat intelligence feed rather than a government-only concern.
Tactical Insight
Immediate actions
- Apply vendor-released patches for CVE-2025-61624 (Fortinet) and CVE-2026-102764 (BeyondTrust) to all affected systems immediately.
- Audit all internet-facing deployments of Fortinet and BeyondTrust products to confirm exposure scope and prioritize remediation.
- Review access logs on affected systems for indicators of compromise consistent with active exploitation.
Long-term improvements
- Subscribe to CISA's KEV Catalog feed and integrate it into your vulnerability management workflow to trigger automated remediation tickets.
- Maintain a continuously updated asset inventory with version tracking for all network security appliances and remote-access tools.
- Establish and test an emergency patching SLA (e.g., 24–72 hours) specifically for KEV-listed or CVSS Critical vulnerabilities on public-facing systems.
Detection measures
- Deploy network-based intrusion detection rules targeting known exploit signatures for the listed CVEs on perimeter and remote-access infrastructure.
- Implement behavioral monitoring on privileged-access tools like BeyondTrust to alert on anomalous session activity or privilege escalation.
- Ensure centralized SIEM logging captures authentication events, configuration changes, and outbound connections from affected systems.