CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The most identity-relevant is CVE-2026-102764, a BeyondTrust Remote Support authentication bypass by spoofing, which could allow attackers to circumvent authentication controls on a privileged remote-access tool. The second, CVE-2025-61624, is a path traversal flaw affecting multiple Fortinet products.
Authentication bypass issues in remote-support and privileged-access platforms are especially dangerous because such tools often hold elevated rights across managed environments. A spoofing-based bypass can let an attacker impersonate a legitimate session and gain footholds that lead to lateral movement and credential compromise within Active Directory and broader infrastructure.
What to take away: Under BOD 26-04, federal agencies must prioritize rapid remediation of KEV-listed flaws on exposed assets, but all organizations running BeyondTrust Remote Support or affected Fortinet products should patch immediately and hunt for signs of pre-patch compromise, particularly anomalous authentication and remote-access activity.