CISA Adds Two Actively Exploited Vulnerabilities to KEV Catalog
Summary
CISA added Fortinet CVE-2025-61624 and BeyondTrust CVE-2026-102764 to its KEV Catalog based on active exploitation. Federal agencies must prioritize remediation under BOD 26-04; CISA urges all organizations to prioritize KEV vulnerabilities.
Key points
- CISA added Fortinet CVE-2025-61624, a path traversal vulnerability affecting multiple products, and BeyondTrust CVE-2026-102764, an authentication bypass by spoofing, to its KEV Catalog.
- The additions are based on evidence that both vulnerabilities are being actively exploited.
- BOD 26-04 requires FCEB agencies to prioritize remediation of listed vulnerabilities on publicly exposed assets that grant total control after exploitation.
- The directive also sets expectations for agencies to check whether systems were compromised before patches were applied.
- CISA encourages all organizations—not only FCEB agencies—to use risk-based vulnerability management and prioritize KEV vulnerabilities.
- Potential KEV nominations must include a CVE ID, evidence of exploitation, and clear mitigation guidance.
Article Details
- Vulnerability Types
- Path traversal
- Authentication bypass by spoofing
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown