CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog by adding two critical vulnerabilities: CVE-2025-61624 related to Fortinet products and CVE-2026-102764 concerning BeyondTrust Remote Support. These entries signify that threat actors are actively using these flaws, presenting a severe security risk, particularly for federal enterprise systems. Federal Civilian Executive Branch (FCEB) agencies are governed by Binding Operational Directive (BOD) 26-04, which mandates they prioritize the rapid patching of high-risk vulnerabilities listed in the KEV Catalog on externally accessible assets that could grant full system control upon exploitation.
While BOD 26-04 is specific to FCEB entities, CISA strongly recommends all organizations adopt this risk-based approach, emphasizing immediate remediation for cataloged threats. The directive also sets expectations regarding proactive investigation into potential pre-patch compromises. The catalog serves as an evolving list of actively weaponized software weaknesses, and CISA invites external submissions if exploitation evidence exists but the vulnerability is not yet listed, provided a CVE ID, proof of exploitation, and mitigation guidance are available.

Two new vulnerabilities were added to the CISA Known Exploited Vulnerabilities (KEV) Catalog.
The added vulnerabilities are CVE-2025-61624 for Fortinet Multiple Products Path Traversal.
The second vulnerability is CVE-2026-102764 for BeyondTrust Remote Support Authentication Bypass by Spoofing.
These types of flaws represent frequent attack vectors targeting the federal enterprise.
Binding Operational Directive (BOD) 26-04 establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies.
BOD 26-04 requires FCEB agencies to prioritize rapid remediation for high-risk vulnerabilities listed in the KEV Catalog on publicly exposed assets granting total control post-exploitation.
Federal agencies are also required under BOD 26-04 to check if threat actors compromised a system before patching occurred.
CISA encourages all organizations, outside of FCEB, to adopt risk-based vulnerability management and prioritize KEV remediation.
Organizations can submit vulnerabilities for potential listing via CISA’s KEV Nomination Form.
Submissions require a CVE ID, evidence of exploitation, and clear mitigation guidance.

The core tension presented here is the necessary gap between threat intelligence dissemination (the catalog) and institutional compliance (BOD 26-04). The strongest narrative supported by the facts is that immediate action against proven threats dictates risk prioritization; known exploitation shifts vulnerabilities from being theoretical weaknesses to actionable, operational threats. This aligns with a principle of active defense: resource allocation must follow adversary focus.
The deeper pattern here relates to the governance treadmill—how agencies are constantly reactive rather than proactively hardened. BOD 26-04 operationalizes risk management into a specific compliance action (prioritize remediation), essentially institutionalizing fear derived from CISA’s evidence base. The unstated assumption, however, is that patching capacity equals threat velocity; organizations can patch faster than adversaries exploit newly disclosed flaws, which historical data frequently contradicts. Furthermore, the reliance on external submission criteria (CVE ID, evidence) creates an asymmetry where threat actors effectively dictate remediation urgency via successful exploitation against systems not yet cataloged.
This dynamic benefits security vendors who create specialized patching/detection tools, and government bodies that achieve measurable compliance metrics based on catalog adherence. The cost is borne by the operational teams—the humans responsible for translating a CVE ID into a patch deployment across complex legacy systems. Second-order consequences include an increasing resource drain on IT departments to perpetually race the exploitation lifecycle.
What mechanisms exist within these directives to account for vulnerabilities that are exploited widely but lack a universally available, vendor-supplied fix? How does the push for rapid remediation potentially incentivize organizations to apply patches without adequate testing, thus introducing new systemic risks? If risk prioritization is entirely dependent on external "evidence of exploitation," what guardrails prevent political pressure from prematurely elevating low-impact flaws above critical, yet currently unexploited, weaknesses?
A coordinated influence campaign might flood the system with high volumes of plausible but unsubstantiated reports to trigger catalog additions (Gish Gallop/Authority Game), hoping to force an unnecessary operational pivot by agencies who fear falling out of compliance. The actual content here is a reporting of established agency policy responses to verified threats, thus remaining relatively clean of manipulative structure.