CISA Flags New Fortinet and BeyondTrust Flaws in Exploited Vulnerabilities List

CISA announced the addition of vulnerabilities affecting Fortinet's suite of products and BeyondTrust's remote support tool to its Known Exploited Vulnerabilities (KEV) catalog, signaling active exploitation in the wild.

The agency's KEV list, maintained to help federal and private entities prioritize remediation, is updated when evidence shows attackers are leveraging specific weaknesses. Inclusion of the Fortinet and BeyondTrust issues indicates that threat actors have successfully weaponized these flaws.

Fortinet's vulnerabilities span several of its security appliances and software offerings, though the agency did not disclose exact product names. The weaknesses are believed to allow unauthenticated attackers to execute code or bypass security controls, raising concerns for organizations that rely on Fortinet firewalls and VPN gateways for network protection.

BeyondTrust's remote support component, used by IT teams to provide off‑site assistance, also appears on the KEV list. Exploitation of this flaw could enable malicious actors to gain remote access to targeted systems, potentially leading to data exfiltration or ransomware deployment.

Cybersecurity experts note that the presence of these flaws in the KEV catalog often correlates with active campaigns observed in threat‑intel feeds. Enterprises are urged to verify whether they run the affected Fortinet or BeyondTrust versions and to apply vendor‑issued patches without delay.

Both vendors have released security advisories recommending immediate updates. Fortinet typically issues firmware updates through its support portal, while BeyondTrust provides patches and mitigation guidance for its remote support suite.

The CISA notice also serves as a reminder that even well‑established security products can harbor critical bugs. Continuous vulnerability management, including regular scanning and timely patch deployment, remains essential to reduce attack surface.

Analysts expect that the addition of these entries will prompt increased monitoring of network traffic for signs of exploitation, such as unusual remote‑access sessions or anomalous firewall behavior. Organizations may also consider compensating controls like network segmentation while patches are applied.

The move underscores the broader trend of nation‑state and criminal groups targeting supply‑chain and remote‑access tools. By publicizing exploited vulnerabilities, CISA aims to accelerate defensive actions across the public and private sectors.