CISA Adds Fortinet Path‑Traversal and BeyondTrust Authentication‑Bypass Flaws to KEV Catalog
What Happened — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) placed two actively‑exploited vulnerabilities into its Known Exploited Vulnerabilities (KEV) catalog: CVE‑2025‑61624, a path‑traversal flaw in multiple Fortinet FortiOS/FortiManager products, and CVE‑2026‑102764, an authentication‑bypass issue in BeyondTrust Remote Support (formerly Bomgar). Both flaws are being leveraged in the wild; the Fortinet bug underpins the PEERSTITCH malware campaign that has compromised more than 500 firewalls, while the BeyondTrust bug enables attackers to gain privileged remote‑access sessions.
Why It Matters for Trust & Control Assurance
- The scenario tests the Vulnerability Management / Patch Management control objective: continuous identification, prioritisation, and remediation of known flaws before they are weaponised.
- Demonstrating timely patching and evidence of remediation satisfies a single control that maps to many frameworks (e.g., NIST CSF 2.0, ISO 27001, SOC 2).
- Leveraging Verisq’s Control‑Mapping capability lets organisations continuously collect, map, and present remediation evidence to auditors and regulators.
Who Is Affected – Network‑security vendors, remote‑support tool providers, and any organisations that run Fortinet firewalls, FortiManager, or BeyondTrust Remote Support—spanning finance, healthcare, government, and cloud‑service operators.
Recommended Actions
- Verify product versions against the CISA advisory; apply the latest FortiOS/FortiManager patches and upgrade BeyondTrust Remote Support to 24.3.1 or later.
- Record patch‑deployment dates and verification screenshots in a central control‑evidence repository.
- Update your vulnerability‑management workflow to flag any KEV‑listed CVEs as “high‑priority” and generate audit‑ready evidence automatically.
Source: Security Affairs
Technical Notes
- Fortinet CVE‑2025‑61624 – Path‑traversal in the FortiOS auto‑script engine; exploited by PEERSTITCH malware to gain stealthy access to firewalls.
- BeyondTrust CVE‑2026‑102764 – Input‑validation flaw in Remote Support’s internal messaging component, allowing authentication bypass via spoofed messages.
- Both vulnerabilities have CVSS v3.1 scores ≥ 9.0 (critical).
Source: same as above