The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added actively exploited flaws affecting Fortinet products and BeyondTrust Remote Support to its Known Exploited Vulnerabilities (KEV) catalog, according to a report published by Security Affairs. The listings do not describe theoretical risk: inclusion in KEV is reserved for vulnerabilities that CISA has confirmed are being used in real attacks.
The update lands against the backdrop of the PEERSTITCH campaign documented by Palo Alto Networks Unit 42, in which a botnet operator abused FortiManager — Fortinet's centralised appliance management console — to push malicious configurations to more than 500 exposed firewalls and exfiltrate their stored configurations. Unit 42 linked the intrusion to a stack-based buffer overflow in FortiManager's fgfmsd service, tracked as CVE-2025-32756.
What CISA added
The KEV additions cover two vendor families: "Fortinet Multiple Products" and "BeyondTrust Remote Support." The Fortinet entry spans multiple appliance lines rather than a single product, so a fix applied against one component may leave other affected products unpatched.
Nor is this the first time Fortinet has landed in the catalog: past KEV additions for the vendor have covered flaws across FortiOS SSL-VPN, FortiWeb, FortiClient EMS, and FortiSwitch, among others. That track record argues for treating each new Fortinet advisory as urgent by default rather than waiting to confirm whether an exploit chain touches your specific deployment.
Per-CVE identifiers, affected version ranges, and the binding remediation deadlines live in CISA's own catalog entry — treat that entry as the patching work order, not any secondary summary. Pull the affected version ranges directly from Fortinet's PSIRT advisory and BeyondTrust's own disclosure, then map each fix against a maintenance window.
Why the management plane is the leverage point
PEERSTITCH illustrates the failure mode that makes this class of vulnerability different from an ordinary client-side bug. FortiManager exists to manage fleets. An attacker who compromises the console inherits its privileges: in this case, configuration pushes that simultaneously compromised hundreds of downstream firewalls and lifted their credentials. One exposed management interface became an entire appliance estate.
That is the pattern security teams should read into the Fortinet KEV entry. BeyondTrust and similar remote-support platforms occupy a structurally similar position — high privilege, internet-reachable by design, and routinely granted exception from normal network segmentation because administrators need them to work.
Reading KEV as a global triage signal
CISA's mandate is U.S. federal civilian infrastructure. The remediation deadlines attached to KEV entries flow from Binding Operational Directive 22-01, which typically gives federal agencies a two-week window to patch listed flaws — and those deadlines formally bind federal agencies only. But the catalog has functioned for years as a de facto global triage list: vendors prioritise KEV-listed bugs in their release cycles, major managed detection and response providers tune detections against it, and insurers and auditors increasingly reference it.
For administrators outside U.S. federal jurisdiction, the operative question is not whether a deadline legally applies. It is that the exploitation window has already opened, and the agency that maintains the most watched catalog of exploited flaws has concluded these bugs meet that bar.
What to do now
Inventory FortiManager instances, Fortinet appliances, and BeyondTrust Remote Support deployments; verify version ranges against vendor advisories; and apply fixes on an emergency-change basis rather than the normal patch cycle. Remote management and support consoles should be reviewed for exposure and access controls at the same time — patching a flaw without reviewing who can reach the interface leaves the PEERSTITCH-style cascade intact.
As a practical step, administrators should also watch local CERT coordination channels — HKCERT among them — for parallel guidance as the vendor advisories evolve.
據 Security Affairs 報導，美國網絡安全和基礎設施安全局（CISA）已將影響 Fortinet 產品及 BeyondTrust Remote Support 的多個正在遭積極利用的漏洞，加入其「已知被利用漏洞」（Known Exploited Vulnerabilities，KEV）目錄。該名單並非描述理論上的風險：漏洞要獲列入 KEV，必須經 CISA 證實已在真實攻擊中被使用。
今次更新的背景，是 Palo Alto Networks Unit 42 所記錄的 PEERSTITCH 攻擊行動。在該行動中，一個 botnet 營運者濫用 FortiManager——即 Fortinet 的中央設備管理主控台——向超過 500 部暴露於網絡的防火牆推送惡意配置，並外洩其儲存的配置資料。Unit 42 將此次入侵與 FortiManager fgfmsd 服務中的一個堆疊緩衝區溢位（stack-based buffer overflow）漏洞關聯起來，該漏洞編號為 CVE-2025-32756。
CISA 列入了哪些漏洞
今次 KEV 新增條目涵蓋兩家供應商的產品：「Fortinet Multiple Products」及「BeyondTrust Remote Support」。Fortinet 的條目橫跨多個設備系列而非單一產品，因此針對某一個元件推出的修補，可能會令其他受影響的產品仍然未獲修補。
這亦不是 Fortinet 首次登上該目錄：過往針對該供應商的 KEV 新增條目，曾涵蓋 FortiOS SSL-VPN、FortiWeb、FortiClient EMS 及 FortiSwitch 等產品的漏洞。這項紀錄顯示，每一份新的 Fortinet 公告都應預設視為緊急事件處理，而不應等待確認攻擊鏈是否涉及你的特定部署。
各個 CVE 識別碼、受影響的版本範圍以及具約束力的修補期限，均載於 CISA 自身的目錄條目之中——應將該條目視為修補工作的指令單，而非任何二手摘要。應直接從 Fortinet 的 PSIRT 公告及 BeyondTrust 自身的披露中取得受影響的版本範圍，再將每項修補對應至維護時段。
為何管理層面是關鍵槓桿點
PEERSTITCH 正好說明了令這類漏洞有別於一般客戶端漏洞的失效模式。FortiManager 的存在目的就是管理機群。攻擊者一旦攻陷該主控台，便繼承其權限：在今次事件中，攻擊者推送配置，同時攻陷了數百部下游防火牆並取得其憑證。一個暴露的管理介面，最終演變成控制整批設備資產。
這正是安全團隊應從 Fortinet KEV 條目中讀出的模式。BeyondTrust 及同類遙距支援平台佔據結構上類似的位置——權限極高、設計上可從互聯網到達，並因為管理員工作所需，經常獲准不受正常網絡分段（segmentation）限制。
將 KEV 視為全球分流信號
CISA 的職權範圍是美國聯邦民用基礎設施。KEV 條目所附的修補期限源自《具約束力的行動指令 22-01》（Binding Operational Directive 22-01），該指令通常賦予聯邦機構兩週時間修補名單上的漏洞——而這些期限在形式上只對聯邦機構具約束力。然而，多年以來，該目錄實際上一直充當全球事實上的分流名單：供應商在發布週期中會優先處理 KEV 列出的漏洞，主要的 managed detection and response 服務商會據此調整偵測規則，保險公司及審計機構亦日益引用該目錄。
對於美國聯邦管轄範圍以外的管理員，關鍵問題並非期限在法律上是否適用，而是漏洞被利用的時間窗口已經打開，而負責維護這份最受矚目的漏洞利用目錄的機構，已判定這些漏洞符合列入標準。
現在應採取的行動
盤點 FortiManager 實例、Fortinet 設備及 BeyondTrust Remote Support 部署；對照供應商公告核實版本範圍；並以緊急變更（emergency change）方式套用修補，而非等待正常修補週期。與此同時，應一併檢視遙距管理及支援主控台的暴露情況及存取控制——修補漏洞卻不檢視誰能接觸該介面，PEERSTITCH 式的連鎖攻擊依然可以重演。
作為一項實務步驟，管理員亦應留意本地 CERT 協調渠道（包括 HKCERT），在供應商公告持續更新時查閱相關指引。