CVE Watch: 17 October 2026, an exploited BeyondTrust auth bypass and a Fortinet CLI path traversal

Two records joined CISA’s Known Exploited Vulnerabilities catalog on 16 October, both with a due date of 19 October: CVE-2026-102764, an authentication bypass in BeyondTrust Remote Support, and CVE-2025-61624, a path traversal in the Fortinet CLI ¹². CISA added both on evidence of active exploitation ¹. The two arrive at very different scores, 9.3 and 6.0, and I would start with the remote-support appliance, because the exploitation there happened on two systems in August and the target was an appliance that holds credentials.

An exploited zero day on a remote-support appliance

BeyondTrust tracks CVE-2026-102764 as improper origin validation in internal messaging components of Remote Support, CWE-290, and the advisory describes the outcome as file operations on the appliance by a remote attacker who holds no credentials ³. The advisory scores it 9.3 under CVSS v4.0, with no privileges required and high impact on the appliance’s confidentiality, integrity and availability ³. BeyondTrust lists every Remote Support version through 26.2.3 as affected, and the BT26-05-RS patch covers 24.3.1 through 26.2.3; an instance older than 24.3.1 has to move to a supported version before that patch applies ³.

BeyondTrust says the actor exploited the flaw on 29 August against one instance the company hosts and one appliance a customer runs, and that its own team contained the hosted instance 27 minutes after the first detection ⁴. The company attributes the activity to a China-nexus espionage group that Mandiant tracks as ARMORY CASTLE, also known as UNC5221 and WARP PANDA, and it says the attribution rests on behavior because the group rebuilds its tooling for each victim ⁴. BeyondTrust pushed the patch to SaaS customers on 8 October, and self-hosted customers have had it available since that day, so on a self-hosted appliance the remaining gap belongs to whoever owns its update path ³⁴. Privileged Remote Access shares the affected code, and BeyondTrust released a patch for it as well, though its own testing did not produce a working exploit there ⁴.

An inventory question comes first for me: whether an appliance of this class exists in my environment, and who signs off on its updates ³. If one does, the flaw’s category sets the review. File operations on the appliance means its configuration and the data it holds, so I want the running version and patch state, the accounts and sessions that cross it, and the access records covering August ¹. CISA’s listing also sets the expectation that a defender checks for prior compromise before the patch goes in ¹.

A path traversal in the Fortinet command line, scored 6.0

CVE-2025-61624 is a path traversal in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, and Fortinet’s advisory says an attacker who holds an admin profile with read-write permissions can write or delete arbitrary files through crafted arguments to commands that ship with the product ⁵. Fortinet published the advisory on 14 April, and CISA listed the flaw on 16 October with a due date of 19 October ⁵⁶. The v3.1 scores disagree: Fortinet’s own score is 6.0 and NVD’s is 6.5, because NVD treats the attack vector as network and Fortinet treats it as local ⁶. Both vectors rate the impact the same way, no confidentiality loss against high integrity and availability loss, and that is where the damage lands on an appliance that holds the configuration ⁶.

Fixes exist inside the supported branches: FortiOS 7.6.5 for the 7.6 line and 7.4.10 for 7.4, FortiProxy 7.6.5 and 7.4.12, FortiPAM 1.7.1, and FortiSwitchManager 7.2.8 and 7.0.7 ⁵. FortiOS 7.2, 7.0 and 6.4 have no fix on their own branch, so those appliances either migrate to a supported release or stay exposed, and a migration takes a maintenance window that a hotfix does not ⁵. Fortinet also ships a virtual patch, FG-VD-59270.0day in FMWP database update 25.120, which can hold the line while someone arranges that window ⁵.

The flaw needs an admin profile, so the first question I raise is who holds read-write on those appliances, and whether admin access is limited to a jump host or open to anything that can reach the management interface. The rest of the review is about destruction. Writing or deleting arbitrary files on a firewall or a switch manager puts the configuration in scope, so I would ask for the configuration backups and the recent change records for those appliances and compare them, because a flaw that deletes files leaves the device running with a configuration nobody has checked.

Both records carry the same 19 October due date, and on each of them the account and file review is what tells me whether anything went through the appliance before the fix; the version number afterwards settles nothing about that.