CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on October 16, 2026: CVE-2025-61624, a Fortinet multiple-products path-traversal vulnerability, and CVE-2026-102764, the BeyondTrust Remote Support authentication-bypass vulnerability covered in a separate CISA alert. The agency says the additions are based on evidence of active exploitation. [1]
The update is a reminder that vulnerability management should be driven by exposure and exploitation evidence, not only by severity scores. A vulnerability in an internet-facing security appliance can deserve immediate attention even when an organization has many other high-severity findings in its queue.
What the KEV catalog means
CISA’s catalog is a prioritized list of vulnerabilities known to be exploited in the wild. Federal civilian agencies have specific obligations under Binding Operational Directive 26-04, but CISA encourages all organizations to use the catalog as part of risk-based vulnerability management. [1] [3]
Being listed does not automatically describe the condition of every deployment. Organizations still need to confirm the affected product, version, exposure and available mitigation. It does mean that the assumption of purely theoretical risk is no longer appropriate.
The Fortinet entry is particularly relevant because security appliances often sit at the boundary between the internet and internal networks. A path-traversal flaw may expose files or information that helps an attacker understand the environment. The exact impact depends on the affected product and deployment, so teams should follow the vendor advisory and CISA’s catalog details rather than infer a universal outcome.
Why exposure changes the response
A device can be vulnerable without being reachable from the public internet, and a device can be exposed through more paths than an inventory record suggests. Reverse proxies, remote-management interfaces, VPN portals, cloud security groups and third-party support arrangements all affect exposure.
Security teams should establish the actual attack surface. Search asset inventories, external scanning results, firewall rules and management-plane records. Confirm whether the affected device stores credentials, can reach privileged networks or provides authentication services to other systems.
If a vulnerable appliance was exposed during a period of active exploitation, patching alone may be insufficient. Teams should review logs, privileged sessions, new accounts and configuration changes. The response should preserve evidence and determine whether credentials or sessions need to be revoked.
Building a better remediation queue
A risk-based queue can combine several signals: active exploitation, internet exposure, privilege, business criticality, ease of exploitation, available patch and evidence of attack activity. The model should be simple enough to run consistently and specific enough to produce an owner and deadline.
Automation can help identify affected assets, but automated closure should be used carefully. A scanner may show that a version changed without proving that the device is fully remediated or that an attacker did not gain access before the update.
Operational teams should also define exception handling. If a patch cannot be applied immediately, the exception should name the asset, business owner, compensating controls, expiry date and review authority. Exceptions should not become an untracked second queue.
CISA’s update supports a practical lesson: the most important vulnerability is often the one that is exploitable on a system with meaningful access. Organizations that connect the KEV catalog to asset exposure, patch ownership and incident response can make faster decisions. Guava Systems can help businesses prioritize exposed infrastructure and coordinate remediation across identity, network and endpoint controls.
References
[1]: https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog “CISA adds two exploited vulnerabilities to the KEV Catalog” [2]: https://www.cve.org/CVERecord?id=CVE-2025-61624 “CVE-2025-61624 — CVE.org” [3]: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk “BOD 26-04 implementation guidance — CISA”
