CISA adds Fortinet and BeyondTrust flaws to the KEV catalog
CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2025-61624, a path traversal affecting several Fortinet products, and CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support (formerly Bomgar). Federal agencies must remediate both by October 19, 2026, and CISA encourages all organizations to prioritize them. If you run affected Fortinet or BeyondTrust appliances, apply the vendor patches now and check for traces of compromise.
Source: https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog
PwnEscape: a guest-to-host VM escape in the Linux kernel
A critical flaw nicknamed PwnEscape, tracked as CVE-2026-99999, lets code inside a guest VM read host kernel memory, crash the host, and—in a lab demonstration—run code as root on the host. The root cause is a trust inversion in how the kernel handles deferred IPv4 checksums, in shared networking code most major cloud providers use; the upstream fix has been merged and backported to all supported stable branches. If you host VMs on an affected kernel, update and reboot so the patched kernel is loaded.
Source: https://almalinux.org/blog/2026-10-16-pwnescape-cve-2026-99999/
China-linked group exploited a BeyondTrust flaw as a zero-day
Mandiant says a China-nexus group it is calling Armory Castle has been exploiting the BeyondTrust Remote Support flaw (CVE-2026-102764) as a zero-day since late August, using it for initial access, then escalating to root and moving laterally. The group deployed the Sawfly webshell and the Bareclaw tunneler and deleted logs to hide its tracks. Self-hosted users should patch immediately, treat any internet-exposed appliance as potentially compromised, and rotate the credentials the appliance stores.
Source: https://cve-security.com/news/2026-10-17