CISA reported that it added two flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The first is CVE-2025-61624, a path traversal vulnerability in several Fortinet products. The second is CVE-2026-102764, an authentication bypass by spoofing in BeyondTrust Remote Support. The text says these vulnerability types are a frequent attack vector and pose significant risks to the federal environment.
The notice cites Binding Operational Directive (BOD) 26-04, which covers prioritizing security updates based on risk and applies to US Federal Civilian Executive Branch agencies. It requires rapid remediation of KEV CVEs on publicly exposed assets that, after exploitation, grant full control, and sets expectations for checking whether threat actors compromised a system before patching. CISA encourages all organizations to adopt risk-based vulnerability management. Anyone aware of an exploited vulnerability not yet in the catalog can submit it through CISA's KEV submission form, with a CVE ID, evidence of exploitation and clear mitigation guidance. When studying this advisory with AI, do not paste asset inventories, host names or credentials; the platform detects personal data, but your team must remove internal technical identifiers.