THE U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Fortinet Multiple Products Path Traversal (CVE-2025-61624) and BeyondTrust Remote Support Authentication Bypass by Spoofing (CVE-2026-102764). The Fortinet flaw concerns the FortiOS auto-script engine, which attackers have used to deliver a PEERSTITCH implant by exploiting the path traversal issue.
Evidence from Palo Alto Networks researchers links PEERSTITCH to compromising more than 500 FortiGate/FortiGate devices via FortiManager and FortiOS memory, with the CVE-2025-61624 flaw enabling initial access and enabling stealthy persistence.
BeyondTrust Remote Support’s CVE-2026-102764 is described as an input-validation vulnerability that can allow an attacker to bypass authentication by spoofing, affecting BeyondTrust Remote Support versions up to 26.2.3, with patches available for supported versions 24.3.1 and later. CISA warns that cyber threat actors are actively exploiting the BeyondTrust flaw to gain initial access, escalate privileges, and move laterally.
Administrations and organisations are obliged under Binding Operational Directive 22-01 to remediate these KEV-listed vulnerabilities. CISA has ordered U.S. federal agencies to apply patches by 19 October 2026. Private organisations are advised to review the KEV catalog and implement the necessary fixes in their infrastructure.
The article preserves the official CVEs and describes the exploitation and patch status as reported by CISA and vendor advisories, noting confirmed exploitation tied to PEERSTITCH for CVE-2025-61624 and indicating that CVE-2026-102764 requires remediation on affected BeyondTrust Remote Support deployments.