Cyber Security· Important
Active Attacks Confirmed Against Fortinet and BeyondTrust Products, CISA Warns
Real-world exploitation has pushed CISA to list two fresh vulnerabilities in its Known Exploited Vulnerabilities (KEV) Catalog: a path traversal bug spanning multiple Fortinet products (CVE-2025-61624) and an authentication-bypass-by-spoofing flaw in BeyondTrust Remote Support (CVE-2026-102764). Because both are already being abused by attackers, Binding Operational Directive 26-04 forces federal civilian agencies to fast-track fixes on any internet-facing systems where exploitation could hand over full control. The directive also requires agencies to check whether a system was already breached before the patch lands. CISA is urging every organization, not only government ones, to follow the same prioritized patching logic.