CISA adds exploited Fortinet and BeyondTrust flaws to KEV as PEERSTITCH edge malware is disclosed
A fix that has been available for six months did not prevent exploitation, which suggests exposed appliances remain unpatched or were compromised before patching. Memory-resident implants on edge devices may not appear in routine patch-compliance reporting, so security teams should run compromise assessments on Fortinet estates rather than treating a current firmware version as proof of a clean device. BeyondTrust Remote Support is a privileged access path into many networks, so any exposed instance should be treated as a priority.
What Happened
On 16 October 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2025-61624, a path traversal flaw in multiple Fortinet products, and CVE-2026-102764, an authentication bypass by spoofing in BeyondTrust Remote Support. The same day, it was reported that a suspected advanced threat actor had exploited a FortiOS flaw to deliver a previously unreported memory-resident ARM64 malware called PEERSTITCH. Fortinet patched the flaw in April 2026.
Why It Matters
A fix that has been available for six months did not prevent exploitation, which suggests exposed appliances remain unpatched or were compromised before patching. Memory-resident implants on edge devices may not appear in routine patch-compliance reporting, so security teams should run compromise assessments on Fortinet estates rather than treating a current firmware version as proof of a clean device. BeyondTrust Remote Support is a privileged access path into many networks, so any exposed instance should be treated as a priority.
Sources
- Cybersecurity and Infrastructure Security Agency (opens in a new tab): CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-16)
- The Hacker News (opens in a new tab): PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions (2026-10-16)
More From This Briefing
- CISA flags exploited Palo Alto PAN-OS, Cisco Secure Email Gateway and Ahsay flaws
- Microsoft withdraws from Nscale's UK data centre deal in Loughton, Essex
- Anthropic commits 5% of its shares to a new public benefit fund
- BMA consultation on responsible AI use in Bermuda financial services closes 30 October
This story is part of the Laurenceo Intelligence briefing for 19 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.