The loudest deadline in this week's cybersecurity news today cycle expired yesterday. On October 16, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog and gave federal agencies just three days — until October 19, 2026 — to remediate them under Binding Operational Directive 26-04. The pair: CVE-2026-102764, an authentication bypass in BeyondTrust Remote Support, and CVE-2025-61624, a path traversal flaw across Fortinet's FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. Both are in the catalog for one reason: there is evidence they are being actively exploited. The deadline has passed. The exposure has not.
For both entries, CISA's required action is the same formula: apply mitigations in accordance with the vendor's instructions, comply with BOD 26-04 and CISA's forensics triage requirements, and — if mitigations are unavailable — discontinue use of the product. Verified against the live CISA KEV catalog (version 2026.10.16) on October 20, 2026.
KEV due dates are risk-tiered: CISA gives agencies longer for lower-risk flaws. A three-day turnaround over a weekend is close to the shortest fuse the catalog uses, and it tells you two things. First, exploitation is not theoretical — KEV admission requires evidence of active exploitation, and independent reporting has tied the BeyondTrust flaw to an active intrusion campaign (see our BeyondTrust zero-day exposure check for the campaign detail). Second, the affected products sit in the worst possible place: remote support appliances and network edge devices — systems that are internet-facing by design and hold privileged access by function. An authentication bypass on a remote support appliance is not a bug in a brochure site; it is a door into the tool your admins use to reach everything else.
CVE-2025-61624 carries a 2025 identifier and Fortinet published its fix months ago, in advisory FG-IR-26-122. So why did CISA list it in October 2026 with a three-day fuse? Because KEV listing tracks exploitation, not disclosure. A patch existing and a patch being applied are different things, and edge appliances are famously left unpatched for months. The catalog entry is CISA saying, in effect: attackers are using this now, against the organizations that never got around to the fix. If your FortiOS, FortiPAM, FortiProxy, or FortiSwitchManager is still unpatched, the age of the fix is not reassurance — it is the problem.
BreachHunter — Ingenious AI's exposure and compromise-hunting platform — is built for exactly this moment: hunting edge-appliance exposure and signs of compromise after a KEV listing lands. Get early access on WhatsApp.
1. When were the two CVEs added to the KEV catalog, and when were they due?
2. What does a KEV listing actually certify?
3. What kind of flaw is CVE-2026-102764 in BeyondTrust Remote Support?
4. Who is legally bound by the October 19 deadline?
5. What does CVE-2025-61624 require of an attacker?
It was the remediation due date CISA set under Binding Operational Directive 26-04 for two vulnerabilities added to the Known Exploited Vulnerabilities (KEV) catalog on October 16, 2026: CVE-2026-102764 in BeyondTrust Remote Support and CVE-2025-61624 in Fortinet products. Federal civilian agencies were required to apply vendor mitigations by October 19, 2026 — a three-day window that signals how serious CISA considers both flaws.
CVE-2026-102764 affects BeyondTrust Remote Support (see vendor advisory BT26-05). CVE-2025-61624 affects Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager (see Fortinet advisory FG-IR-26-122).
No. KEV due dates under BOD 26-04 are legally binding only on US federal civilian executive branch agencies. For private organizations the deadline is not a legal obligation — but it is CISA's strongest public prioritization signal, because a vulnerability only enters the KEV catalog when there is evidence of active exploitation. If you run these products unpatched, the deadline passing does not reduce your risk; the exploitation is the risk.
It is an authentication bypass by spoofing vulnerability (CWE-290). Per CISA's catalog description, it could allow a remote attacker to perform file operations on the appliance. CISA's required action is to apply mitigations per the vendor's instructions (advisory BT26-05), follow BOD 26-04 and forensics triage requirements, and discontinue use of the product if mitigations are unavailable.
Patch or apply the vendor mitigations now — the deadline passing does not close the exposure. Then run CISA's forensics triage requirements to check for signs of compromise, evaluate each affected asset's internet exposure, and, if mitigations are genuinely unavailable, follow CISA's guidance to discontinue use of the product until they are.
Sources: CISA Known Exploited Vulnerabilities Catalog (catalog version 2026.10.16, 1,748 entries — both CVE entries verified directly against the catalog data on October 20, 2026) · BeyondTrust advisory BT26-05 · Fortinet advisory FG-IR-26-122.