BeyondTrust and Fortinet enter the exploited catalog
On 17 October 2026, the CISA catalog is version 2026.10.16, with 1,748 entries, released on 16 October at 17:15 UTC. CVE-2026-102764 targets BeyondTrust Remote Support through 26.2.3, with no account required. CVE-2025-61624 targets Fortinet products, and it requires an admin account that is already open. The due date written on the entries is 19 October.
Getting started
Generated image · SecuFocus
At a glance
Key points
If you expose a self-hosted BeyondTrust Remote Support appliance at 26.2.3 or earlier, CISA says the flaw is exploited for initial access. The Fortinet entry from the same day is not the same action: it requires an admin. If you run neither, this note changes nothing.
What changes
On 17 October 2026, the JSON feed of the known exploited vulnerabilities catalog is version 2026.10.16, with 1,748 entries, released on 16 October 2026 at 17:15 UTC. The 16 October reading still saw version 2026.10.15 and 1,746 entries. Two entries were added on 16 October. Their due date is 19 October 2026. Neither is marked as known in a ransomware campaign: the field says Unknown. Forensic triage says Yes for both.
The CISA alert of 16 October 2026 that announces two additions names CVE-2025-61624 and CVE-2026-102764. It says they were added based on evidence of active exploitation. It does not give a product version. It recalls that directive BOD 26-04 applies to United States federal civilian agencies, and that CISA encourages other organizations to handle catalog entries first. We did not reread the full text of the directive. 19 October is the date written in the catalog. It is not a deadline SecuFocus sets.
A second alert, the same day, speaks only about BeyondTrust. Due dates already noted did not move in this feed: Atlassian remains 18 October, the four additions of 14 October remain 17 October, and Ivanti and Windows remain 16 October.
Two actions, not one
BeyondTrust Remote Support, formerly Bomgar, CVE-2026-102764. The catalog calls it an authentication bypass by spoofing: a remote attacker can perform file operations on the appliance. The named weakness is CWE-290. The due date is 19 October. The ransomware field says Unknown. Forensic triage says Yes.
The CISA alert of 16 October that asks for the patch targets versions 26.2.3 and earlier. It says patches exist for supported versions, from 24.3.1 onward, and that an older version must be upgraded first. It writes that actors are exploiting the flaw for initial access, then for persistence, privilege escalation and lateral movement. It names the BT26-05-RS patch for self-hosted appliances. It writes that BeyondTrust-hosted deployments, the SaaS mode, are already patched. We did not open the vendor console. It also asks to limit external access to the appliance and to keep administrative interfaces on trusted networks.
The NVD record, read through the API on 17 October 2026, is Analyzed. It was published on 15 October 2026 at 21:17 UTC and modified on 17 October 2026 at 04:16 UTC. The NVD HTML page did not render the record: an anti-bot check returned an empty shell. We cite the API. The English description says internal components did not adequately validate the origin of messages they received, and that, under the right conditions, an attacker can perform file operations on the appliance. The CVSS 3.1 score carried by nvd@nist.gov is 9.8, critical, network, no account, no interaction. A CPE list stops at 26.2.3 inclusive, with no start version. The CISA coordinator, timestamped 16 October at 00:00 UTC, marks exploitation as active, automatable, technical impact total. The 24.3.1 floor comes from the CISA alert, not from that CPE list.
Fortinet, CVE-2025-61624. The catalog calls it a path traversal in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager: an already authenticated attacker, with an admin profile and at least read-write permissions, can write or delete arbitrary files through specific CLI commands. The named weakness is CWE-22. The due date is 19 October. The ransomware field says Unknown. Forensic triage says Yes. This is not the BeyondTrust action: here, the catalog requires an admin account.
The NVD record, read through the same API on 17 October 2026, is Analyzed. It was published on 14 April 2026 at 16:16 UTC and modified on 17 October 2026 at 04:16 UTC. The catalog entry is from 16 October. The flaw itself has been described since April. The English description targets FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2, 7.0 and 6.4 in all versions, FortiPAM 1.7.0 and all versions from 1.6 down to 1.0, FortiProxy 7.6.0 through 7.6.4 and 7.4.0 through 7.4.11, FortiProxy 7.2 and 7.0 in all versions, FortiSwitchManager 7.2.0 through 7.2.7 and 7.0.0 through 7.0.6. The CVSS 3.1 score carried by psirt@fortinet.com is 6.0, medium, local vector, high privileges. The record we read does not carry a primary NVD score. The CISA coordinator, timestamped 15 October at 00:00 UTC, marks exploitation as active, not automatable, technical impact total.
The CPE bounds exclude, by branch, versions from 7.4.10 and 7.6.5 for FortiOS, 1.7.1 for FortiPAM, 7.4.12 and 7.6.5 for FortiProxy, 7.0.7 and 7.2.8 for FortiSwitchManager. We do not treat those numbers as files we have in hand. The description is narrower than the broad CPE range that starts at 6.4.0. We do not pick a safe version.
What we did not check
We do not have a BeyondTrust appliance, nor FortiOS, FortiPAM, FortiProxy or FortiSwitchManager. We did not replay the identifiers. Exploited comes from the catalog addition, the two alerts of 16 October, and the CISA coordinator mark in the NVD records. It is not a SecuFocus test. Unknown in the ransomware field does not prove that a campaign is absent.
We did not open the BeyondTrust, Fortinet, Mandiant or Siemens pages: they are not on the source list we cite. The patch name BT26-05-RS, the 24.3.1 floor, and the sentence that SaaS is already patched come from the CISA alert, not from a file we downloaded. The Fortinet ranges come from the NVD description and the CPE bounds, not from an image we installed. A CPE configuration also names Siemens Ruggedcom APE1808 firmware. The NVD description does not name Siemens. We do not say that box is affected.
The decision
If you expose a self-hosted BeyondTrust Remote Support appliance at 26.2.3 or earlier, CISA says the flaw is exploited for initial access. Apply the patch it names, BT26-05-RS, or upgrade first if you are before 24.3.1. It also asks you to limit external access and, if you suspect a compromise, to isolate the appliance, keep an image, forward the logs, then rebuild and rotate the secrets the appliance held. For SaaS, the alert says it is already patched. We did not recheck that with the vendor.
If you run one of the named Fortinet versions, the catalog calls them exploited, with a due date of 19 October written on the entry. The action is not the same: it takes an admin account with write rights, and CLI commands. Do not treat that line as the BeyondTrust case with no account. We do not declare a safe version from the CPE bounds.
If you run none of these products, this note changes nothing. Atlassian, due 18 October, and the four additions of 14 October, due 17 October, already have their notes.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.