CISA KEV Alert: Fortinet Path Traversal & BeyondTrust Auth Bypass Now Actively Exploited
What BOD 26-04 Means for Federal Agencies—and Why Every Enterprise Should Act Within 30 Days
Published 2026-10-16
# CISA KEV Alert: Fortinet Path Traversal & BeyondTrust Auth Bypass Now Actively Exploited
CISA has added two actively exploited vulnerabilities—CVE-2025-61624 affecting multiple Fortinet products and CVE-2026-102764 affecting BeyondTrust Remote Support—to its Known Exploited Vulnerabilities (KEV) Catalog, simultaneously invoking Binding Operational Directive (BOD) 26-04 to enforce prioritised remediation across federal civilian agencies.
What Happened and What the Rules Require
Both vulnerabilities represent high-impact attack classes. The Fortinet entry is a path traversal flaw that can allow an unauthenticated or low-privilege attacker to read sensitive files outside the intended directory scope—a classic precursor to credential theft and lateral movement. The BeyondTrust entry is an authentication bypass via spoofing, meaning an attacker could impersonate a legitimate user to gain access to privileged remote-support sessions without valid credentials.
CISA's evidence of active exploitation means these are not theoretical risks; threat actors are already weaponising them in the wild.
BOD 26-04 elevates the urgency for Federal Civilian Executive Branch (FCEB) agencies by requiring:
- Rapid remediation of KEV-listed vulnerabilities on publicly exposed assets where exploitation grants total control.
- Compromise assessment checks to determine whether an attacker accessed the system before a patch was applied.
- Documented prioritisation processes that distinguish high-risk KEV items from lower-severity findings.
Why It Matters Beyond the Federal Perimeter
While BOD 26-04 is binding only on FCEB agencies, the KEV Catalog has become the de-facto vulnerability triage benchmark across the private sector. Regulators and auditors referencing NIS2, ISO 27001, SOC 2, PCI DSS, and HIPAA increasingly expect organisations to demonstrate that critical, actively exploited CVEs are treated with the same urgency that BOD 26-04 mandates for federal bodies.
- NIS2 requires essential and important entities to implement vulnerability handling and rapid incident response—KEV status is hard evidence of "significant risk."
- ISO 27001 (Annex A 8.8) demands a managed process for addressing technical vulnerabilities in a timely manner.
- PCI DSS v4 requires critical patches to be applied within one month and mandates ongoing vulnerability management programs.
- SOC 2 CC7.1 expects monitoring of system components for vulnerabilities.
- HIPAA requires covered entities to evaluate and reduce risks to ePHI, which includes unpatched network security appliances and remote-access tooling.
Fortinet and BeyondTrust products frequently appear in healthcare, financial services, and critical infrastructure environments—sectors subject to all five frameworks above. A compromise of a BeyondTrust remote-support session, for example, could hand an attacker privileged access to multiple downstream systems in minutes.
What to Do in the Next 7–30 Days
Days 1–7: Identify and isolate exposure. Inventory every instance of affected Fortinet products and BeyondTrust Remote Support across your environment, including cloud-hosted and third-party-managed instances. Prioritise internet-facing assets first.
Days 1–7: Assess for prior compromise. Before patching, run integrity checks and log reviews to determine whether either vulnerability was exploited before your patch window opens—exactly what BOD 26-04 mandates for federal agencies, and best practice for everyone else.
Days 7–14: Apply vendor patches. Apply the vendor-supplied updates as soon as your change-management process allows. Document the patch date, system state before and after, and any anomalies found during compromise assessment.
Days 14–30: Map findings to your compliance posture. Update your risk register and evidence packs for NIS2, ISO 27001, SOC 2, PCI DSS, or HIPAA as applicable. If you cannot demonstrate timely remediation of KEV items, you have a documented gap that auditors will find.
Ongoing: Automate KEV monitoring. Manual tracking of the KEV Catalog is error-prone at scale. Integrate continuous vulnerability intelligence into your SOC workflow so that future additions trigger immediate triage tasks.
Close the Gap with RDS GoSOC AI—Free for 14 Days
RDS GoSOC AI maps your vulnerability and incident data against 27 compliance frameworks—including NIS2, ISO 27001, SOC 2, PCI DSS, and HIPAA—giving you a real-time view of where KEV-class findings create regulatory exposure. Start a 14-day free trial with every paid feature unlocked, no credit card required, at https://platform.reremrdsgosoc.com/register. Once inside, open the User Guide tab to get oriented quickly, and use the Sage AI handle to ask setup questions in plain language. Your compliance evidence doesn't have to wait for your next audit cycle.
---
#MSP #ManagedServices #CMMC #FedRamp #CyberSecurity #SOC #SecurityOperations #MSSP #ThreatDetection #Compliance #CloudSecurity #IdentitySecurity #SecurityMonitoring #ITServices #CyberResilience #ManagedSecurity #BusinessGrowth