[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fd8ASyhTTtJEd9XlNiQNXQ-sfdWkHkdEL-HH4ErIcc-I":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":41,"controls":42},"7e90f01a-8119-47d1-a548-1853e303c6af","active-exploitation-of-fortinet-and-beyondtrust-flaws-highlights-patch-urgency","bc28aec3-0333-4efc-865d-716ae728b924","Active Exploitation of Fortinet and BeyondTrust Flaws Highlights Patch Urgency","CISA's addition of CVE-2025-61624 and CVE-2026-102764 to the Known Exploited Vulnerabilities Catalog confirms that threat actors are actively exploiting unpatched flaws in Fortinet products and BeyondTrust Remote Support — two widely deployed enterprise tools. The root cause is a failure to apply vendor patches promptly, leaving publicly exposed assets as easy targets for malicious actors. BeyondTrust and Fortinet products are high-value targets because they often hold privileged access to internal networks, meaning a successful exploit can serve as a launchpad for lateral movement or data exfiltration. Federal agencies are legally obligated under BOD 26-04 to remediate these vulnerabilities, but the broader private sector should treat the KEV Catalog as an urgent, actionable threat intelligence feed rather than a government-only concern.","**Immediate actions:**\n- Apply vendor-released patches for CVE-2025-61624 (Fortinet) and CVE-2026-102764 (BeyondTrust) to all affected systems immediately.\n- Audit all internet-facing deployments of Fortinet and BeyondTrust products to confirm exposure scope and prioritize remediation.\n- Review access logs on affected systems for indicators of compromise consistent with active exploitation.\n\n**Long-term improvements:**\n- Subscribe to CISA's KEV Catalog feed and integrate it into your vulnerability management workflow to trigger automated remediation tickets.\n- Maintain a continuously updated asset inventory with version tracking for all network security appliances and remote-access tools.\n- Establish and test an emergency patching SLA (e.g., 24–72 hours) specifically for KEV-listed or CVSS Critical vulnerabilities on public-facing systems.\n\n**Detection measures:**\n- Deploy network-based intrusion detection rules targeting known exploit signatures for the listed CVEs on perimeter and remote-access infrastructure.\n- Implement behavioral monitoring on privileged-access tools like BeyondTrust to alert on anomalous session activity or privilege escalation.\n- Ensure centralized SIEM logging captures authentication events, configuration changes, and outbound connections from affected systems.",[12,13,14,15,16,17,18,19],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","CISA BOD 26-04: Reducing the Significant Risk of Known Exploited Vulnerabilities","ITIL Change Management: Emergency Change Procedures","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning",{},"published","2026-10-16T20:21:00.618762+00:00","2026-10-16T20:21:00.599+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F10\u002F16\u002Fcisa-adds-two-known-exploited-vulnerabilities-catalog","cisa-adds-two-known-exploited-vulnerabilities-to-catalog-ae4608","CISA Adds Two Known Exploited Vulnerabilities to Catalog",[29,35],{"id":30,"name":31,"slug":32,"description":33,"color":34},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":36,"name":37,"slug":38,"description":39,"color":40},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[43,46,49],{"slug":32,"name":44,"problem":45},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":38,"name":47,"problem":48},"Automated patch management","Known holes get closed in days, not months.",{"slug":50,"name":51,"problem":52},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have."]