U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog.The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:CVE-2025-61624 Fortinet Multiple Products Path Traversal VulnerabilityCVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability This week, Palo Alto Netwoks researchers reported that PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, evade detection inside FortiOS memory, and maintain stealthy access.The attackers exploited CVE-2025-61624, a path traversal flaw in the FortiOS auto-script engine, to deploy a new implant called PEERSTITCH. The flaw CVE-2026-102764 is an input validation vulnerability in internal components of BeyondTrust Remote Support. BeyondTrust Remote Support is a remote technical support tool that allows IT help desks and support teams to securely access and troubleshoot users’ computers and other devices over a network. From a cybersecurity perspective, the software is important because it can provide privileged access to systems and allow technicians to perform sensitive operations.The components do not properly validate the origin of incoming messages, potentially allowing an attacker to perform file operations on the appliance under certain conditions.“CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first.” CISA warns. “Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. “According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.CISA orders federal agencies to fix the flaws by October 19, 2026.Follow me on Twitter: @securityaffairs and Facebook and MastodonPierluigi Paganini(SecurityAffairs – hacking, CISA)