Federal cybersecurity authorities have updated the Known Exploited Vulnerabilities catalog under Binding Operational Directive 26-04 to mandate emergency remediation for two actively weaponized perimeter access flaws. Unauthenticated remote adversaries exploit origin validation and path traversal bugs to achieve root privileges across enterprise remote support servers and security appliances.
The catalog additions feature BeyondTrust Remote Support and Privileged Remote Access authentication bypass vulnerability CVE-2026-102764 carrying a CVSS score of 9.3 alongside Fortinet path traversal flaw CVE-2025-61624. Confirmed threat telemetry indicates Chinese state-nexus group Armory Castle actively exploited the BeyondTrust zero-day for nearly seven weeks prior to disclosure, deploying custom web shells and wiping local system logs. Federal civilian executive branch agencies face a mandatory November 7 compliance deadline.
Subverting privileged remote access gateways exposes internal enterprise subnets and managed endpoints. Because BeyondTrust appliances maintain elevated administrative connections to remote endpoints, an unauthenticated gateway takeover permits threat actors to extract stored vault credentials, execute arbitrary commands, and move laterally across corporate networks.
– Apply official maintenance updates published in advisory BT26-05 across all self-hosted BeyondTrust appliances immediately.
– Centralize event log forwarding to off-box SIEM systems to prevent local log deletion routines from destroying forensic evidence.
– Restrict public network exposure of BeyondTrust and Fortinet management portals using zero trust access proxies.
– Rotate administrative credentials managed within privileged remote access vaults and inspect active user session logs.
Privileged remote access security relies on off-box audit logging and rapid patch execution to ensure administrative gateways remain protected against state-sponsored zero-day exploitation chains. #CodeDefence #BeyondTrust #Fortinet #CISA #KEV #ZeroDay #AuthBypass #AppSec #PatchManagement
/
