CISA Adds Critical Fortinet and BeyondTrust Zero-Day Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency issued a binding operational directive on Friday, formally adding critical zero-day vulnerabilities affecting Fortinet enterprise network gateways and BeyondTrust remote access appliances to its Known Exploited Vulnerabilities Catalog. The federal cybersecurity directive mandates that all federal civilian executive agencies apply certified vendor remediation patches by November 6, following forensic evidence confirming that sophisticated nation-state threat actors are actively exploiting the flaws in targeted corporate and government networks. Security engineers issued technical bulletins during an emergency threat briefing in Washington and San Francisco.

Forensic vulnerability analyses published by incident responders revealed that the BeyondTrust flaw, tracked as CVE-2026-102764, allows unauthenticated remote attackers to execute arbitrary system commands with elevated root privileges across internet-facing remote support servers. Threat intelligence specialists from Mandiant confirmed that advanced persistent threat groups linked to state-sponsored actors have weaponized the exploit since late August to establish stealthy persistence, dump credential caches, and navigate lateral enterprise networks. A companion Fortinet advisory addressed path traversal weaknesses that permit unauthorized configuration modifications on perimeter firewall appliances.

Chief information security officers and enterprise infrastructure directors across Silicon Valley initiated emergency perimeter audits upon publication of the federal directive. Enterprise security architects emphasized that remote support appliances often maintain unrestricted firewall tunnels into internal production domains, making appliance vulnerabilities an existential security threat for enterprise cloud environments. Cybersecurity analysts commended the vendors for coordinating accelerated emergency patch releases, urging private sector organizations to prioritize immediate patching over standard maintenance schedules.

CISA executive leadership reiterated that vulnerabilities included in the Known Exploited Vulnerabilities Catalog present verified, ongoing attack vectors against the national digital ecosystem. Federal compliance guidelines dictate that agencies failing to apply vendor security updates within the prescribed deadline will be required to disconnect affected network appliances immediately from federal wide-area networks. Official advisory documents confirm that automated network scanning teams will conduct continuous verification probes to detect unpatched internet-facing gateway assets.

Enterprise system administrators, security analysts, and corporate network defenders can inspect technical vulnerability signatures, mitigation scripts, and vendor patch advisories through the official portal at cisa.gov. CISA will host an emergency technical briefing for critical infrastructure operators on Wednesday, October 28, covering lateral movement detection in compromised appliance environments. Corporate security teams seeking threat hunting indicators of compromise may access automated threat feeds through the CISA Automated Indicator Sharing program.