CISA Adds Two Vulnerabilities to Known Exploited Vulnerabilities Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation.

The newly added vulnerabilities include CVE-2025-61624, a Fortinet Multiple Products Path Traversal Vulnerability, and CVE-2026-102764, identified as a BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability.

While Binding Operational Directive (BOD) 26-04 establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize the remediation of vulnerabilities listed in the KEV Catalog.

References

• https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog