CISA Adds Two New Known Exploited Vulnerabilities to its Catalog, Urges Federal Agencies to Prioritize Remediation

The Cybersecurity and Infrastructure Security Agency (CISA) announced on October 16, 2026, the addition of two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. The vulnerabilities are CVE-2025-61624 (Fortinet Multiple Products Path Traversal Vulnerability) and CVE-2026-102764 (BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability). CISA emphasizes that these types of vulnerabilities are frequently exploited by malicious cyber actors and pose significant risks to federal enterprises. Federal Civilian Executive Branch (FCEB) agencies are mandated by Binding Operational Directive (BOD) 26-04 to prioritize rapid remediation of high-risk vulnerabilities, particularly those in the KEV Catalog on publicly exposed assets.