WASHINGTON
Federal network defenders got a short deadline and a long weekend problem on Friday. The Cybersecurity and Infrastructure Security Agency added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on October 16 — one in Fortinet’s widely deployed security products, one in BeyondTrust Remote Support — and gave federal civilian agencies until October 19, 2026 to remediate them. Three days, for flaws that attackers are not waiting three days to use.
The Fortinet entry, CVE-2025-61624, is a path traversal vulnerability in the auto-script engine of FortiOS, affecting multiple Fortinet products. The BeyondTrust entry, CVE-2026-102764, is an authentication bypass by spoofing in BeyondTrust Remote Support — the kind of flaw that turns a legitimate remote-access tool into an open door. Both products sit exactly where attackers want to be: at the edge of the network, holding privileged access to everything behind it. CISA does not add vulnerabilities to the KEV catalog on suspicion. Listing means exploitation is confirmed in the wild.
500 Firewalls and a Memory-Only Implant
The Fortinet side of this story already has a body count of exposed systems. Palo Alto Networks’ Unit 42 research team reports that attackers used the FortiOS flaw to deploy an implant it calls PEERSTITCH — malware that lives only in memory, leaving little for traditional file-based detection to find — and that more than 500 firewalls were exposed through FortiManager, Fortinet’s centralized management platform. That detail matters: compromise the manager and you do not just own one firewall, you inherit the map and the keys to the fleet it administers.
The BeyondTrust Flaw Has Been Busy Since August
The BeyondTrust vulnerability carries the more alarming timeline. Mandiant and Google’s Threat Intelligence Group attribute zero-day exploitation of the flaw, going back to late August, to a suspected China-nexus group tracked as ARMORY CASTLE — formerly UNC5221, a name familiar to anyone who followed earlier edge-device campaigns. Per the threat reporting, the attackers deployed the SAWFLY web shell and the BARECLAW tunneler, escalated to root, and dumped credential vaults — a full-spectrum intrusion kit aimed at staying inside quietly.
BeyondTrust’s own response moved on a compressed schedule: the BT26-05 patch shipped October 8, SaaS customers were patched on October 9, and coordinated public disclosure landed October 15. Versions 26.2.3 and earlier are affected. Patches are available for supported versions 24.3.1 and later; organizations running older versions have to upgrade to get covered — there is no patch coming for the oldest deployments, which is precisely the population attackers count on. Threat briefs rate the flaw CVSS 9.3, critical.
A Deadline With Teeth
The KEV catalog is binding on federal civilian agencies under CISA’s Binding Operational Directive 22-01, but its real audience is everyone. The catalog functions as the closest thing the security industry has to a consensus triage list: if it is on the KEV, patch it before the thing you were planning to patch instead. An October 19 deadline — three days, spanning a weekend — signals that CISA considers exploitation active enough that the usual remediation windows would be negligent.
What Defenders Are Being Told to Do
The remediation advice is unglamorous and urgent. Fortinet customers should apply the vendor's fixes for the FortiOS auto-script flaw and audit FortiManager exposure — Unit 42's reporting on more than 500 exposed firewalls suggests plenty of organizations will find this is not a hypothetical exercise. BeyondTrust customers on Remote Support 26.2.3 or earlier should confirm the BT26-05 patch is applied, and those on versions older than the supported 24.3.1 line should treat the required upgrade as an emergency change, not a roadmap item. In both cases, patching alone is not the finish line: because exploitation predates disclosure — by weeks in the BeyondTrust case, with web shells, tunnelers and credential theft in the reported toolkit — defenders are being urged to hunt for signs of compromise, rotate credentials that edge devices could have exposed, and review privileged access paths before declaring the incident closed.
For context on how unusual the timeline is: the KEV catalog was created under Binding Operational Directive 22-01 in November 2021, and its standard remediation windows run to two weeks for recently disclosed vulnerabilities and six months for older ones. A three-day turnaround is the catalog’s emergency gear, reserved for flaws where exploitation is not a forecast but a field report. It also lands on a Saturday-to-Monday stretch, which means the agencies and companies that take the listing seriously will be pulling patch windows, vendor calls and compromise hunts into the weekend — while those that wait for business hours will spend those same hours inside the window attackers are actively working.
There is a broader pattern here that should bother anyone running a network, which is to say everyone. Edge devices — firewalls, VPN gateways, remote support tools — have become the preferred front door for sophisticated intruders, because they are powerful, internet-facing and historically slow to patch. A memory-only implant in your firewall manager and a credential-vault dump out of your remote support platform are not two unrelated incidents; they are the same strategy executed twice. The patch is available for both. By Monday, “we hadn’t gotten to it yet” stops being a scheduling explanation and starts being the incident report’s first sentence.