CISA, the US cyber defense agency, said on 16 October that it added two flaws to its Known Exploited Vulnerabilities (KEV) Catalog. The catalog lists security holes that attackers are already using. CISA said it has evidence of active exploitation. The first flaw, CVE-2025-61624, is a path traversal bug in multiple Fortinet products. Path traversal lets an attacker reach files outside the area meant for them. The second, CVE-2026-102764, is a login bypass in BeyondTrust Remote Support, done by spoofing, which means faking an identity.
CISA's notice does not say which Fortinet products or versions are affected. It does not name the attackers or say how many systems were hit. It gives no fix details or deadlines for these two entries. The agency did restate a rule for US federal civilian agencies, called BOD 26-04. It tells them to fix the riskiest listed flaws first, meaning those on publicly exposed systems that give full control. It also sets expectations for checking whether attackers got in before the patch.
CISA said that rule covers only federal civilian agencies. It still urged all organizations to rank their fixes by risk and to treat KEV entries as a priority. Teams that run Fortinet products or BeyondTrust Remote Support have a clear reason to check their systems against these two entries.