CVE-2025-61624 & CVE-2026-102764: CISA KEV Alert for Fortinet Path Traversal and BeyondTrust Auth Bypass — Detection and Remediation Guide

---
title: Path Traversal Attempt Against Fortinet Management Interface
id: 3f8c1a92-6d47-4e5b-9a21-c7e4f0b2d8a1
status: experimental
description: Detects path traversal sequences in HTTP requests targeting Fortinet appliance management and API endpoints, consistent with exploitation of CVE-2025-61624.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/16
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_traversal:
    c-uri|contains:
      - '../'
      - '..%2f'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '..%252f'
      - '%252e%252e'
      - '..\\'
  selection_sensitive:
    c-uri|contains:
      - '/etc/'
      - 'passwd'
      - 'shadow'
      - 'forticloud'
      - 'vpn'
      - '.conf'
      - 'sslvpn'
  condition: selection_traversal and selection_sensitive
falsepositives:
  - Vulnerability scanners and authorized penetration tests
level: high
---
title: HTTP Response Indicating Successful File Read on Fortinet Appliance
id: 8b2e4d61-1f93-4c27-a856-9d3b7e5f2c40
status: experimental
description: Detects successful (200) responses to requests containing encoded traversal sequences against Fortinet-hosted endpoints, indicating possible successful exploitation of CVE-2025-61624 rather than mere scanning.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/10/16
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    c-uri|contains:
      - '%2e%2e'
      - '..%2f'
      - '%252e%252e'
    sc-status: 200
  condition: selection
falsepositives:
  - Authorized scanning activity; correlate with scanner source IPs
level: critical
---
title: Anomalous BeyondTrust Remote Support Session Establishment
id: 5c7a9f13-2e68-4d41-b037-6f1a8c3d9e52
status: experimental
description: Detects suspicious patterns in BeyondTrust Remote Support authentication and session logs potentially consistent with CVE-2026-102764 spoofing-based authentication bypass, including sessions without preceding successful authentication events.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/10/16
tags:
  - attack.persistence
  - attack.initial_access
  - attack.t1078
logsource:
  category: application
  product: beyondtrust
detection:
  selection:
    EventType|contains:
      - 'session_start'
      - 'representative_login'
      - 'jump_item_access'
    AuthResult:
      - 'bypassed'
      - 'spoofed'
      - 'unverified'
  condition: selection
falsepositives:
  - Misconfigured integrations; validate against change records
level: high

// Hunt 1: Path traversal attempts targeting Fortinet appliances (proxy/WAF logs + CEF-ingested syslog)
let lookback = 30d;
let traversal = dynamic(["../", "..%2f", "%2e%2e%2f", "%252e%252e", "..%5c", "..\\"]);
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor =~ "Fortinet" or RequestURL has_any (traversal)
| where RequestURL has_any (traversal)
| extend EncodedTraversal = RequestURL matches regex @"(%25)?2e(%25)?2e"
| summarize AttemptCount = count(), DistinctTargets = dcount(DestinationIP), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by SourceIP, RequestURL, DeviceAction, ApplicationProtocol
| where AttemptCount > 2 or EncodedTraversal
| order by LastSeen desc;

// Hunt 2: BeyondTrust Remote Support sessions without a preceding successful authentication
// Ingest BeyondTrust syslog via the Syslog or CommonSecurityLog connector
let lookback = 14d;
Syslog
| where TimeGenerated > ago(lookback)
| where ProcessName has_any ("beyondtrust", "bomgar") or SyslogMessage has "Remote Support"
| where SyslogMessage has_any ("session started", "jump item", "representative")
| extend SessionUser = extract(@"user[=:]?(\S+)", 1, SyslogMessage)
| extend SrcIP = extract(@"(src|source)[=:]?(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 2, SyslogMessage)
| summarize Sessions = count(), FirstSession = min(TimeGenerated), LastSession = max(TimeGenerated)
  by SessionUser, SrcIP
| join kind=leftanti (
    Syslog
    | where TimeGenerated > ago(lookback)
    | where SyslogMessage has_any ("authentication successful", "login successful")
    | extend AuthUser = extract(@"user[=:]?(\S+)", 1, SyslogMessage)
    | summarize by AuthUser
) on $left.SessionUser == $right.AuthUser
| project SessionUser, SrcIP, Sessions, FirstSession, LastSession
| order by Sessions desc;

-- Hunt for BeyondTrust Remote Support client processes spawning unexpected children
-- (post-exploitation via a hijacked privileged remote session)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)bomgar|beyondtrust|srs-|jumpclient'
   OR (SELECT Name FROM pslist() WHERE Pid = Ppid) =~ '(?i)bomgar|beyondtrust'

-- Correlate: unexpected outbound connections from remote-support tooling
SELECT Pid, Name, RemoteIP, RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)bomgar|beyondtrust'
  AND RemoteIP !~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)'
  AND Status =~ 'ESTAB'

#!/bin/bash
# CVE-2025-61624 / CVE-2026-102764 exposure verification
# 1) Enumerate internet-facing Fortinet management interfaces from your external attack surface inventory
#    Replace targets.txt with your appliance list (one host:port per line)

while read -r target; do
  echo "=== Testing $target for traversal exposure (CVE-2025-61624) ==="
  # Benign probe: request a traversal path and check whether the appliance returns file content
  response=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 10 \
    "https://$target/..%2f..%2f..%2fetc%2fpasswd")
  echo "HTTP status: $response"
  if [ "$response" == "200" ]; then
    echo "[ALERT] $target returned 200 on traversal probe — investigate immediately"
  fi
done < targets.txt

# 2) Check FortiOS firmware version against vendor advisory (run on the appliance via CLI)
#    ssh admin@<fortigate> 'get system status | grep Version'
#    Compare against fixed versions listed at https://www.fortiguard.com/psirt

# 3) Verify BeyondTrust Remote Support site version
#    Log into /appliance and check the version string against the fixed build in the
#    BeyondTrust advisory: https://www.beyondtrust.com/trust-center/security-advisories

# Inventory BeyondTrust Remote Support client deployments and check versions across Windows endpoints
$computers = Get-ADComputer -Filter * -Properties OperatingSystem |
  Where-Object {$_.OperatingSystem -like "*Windows*"} | Select-Object -ExpandProperty Name

foreach ($c in $computers) {
  try {
    $sw = Invoke-Command -ComputerName $c -ErrorAction Stop -ScriptBlock {
      Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
                       "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue |
        Where-Object {$_.DisplayName -match "BeyondTrust|Bomgar"} |
        Select-Object DisplayName, DisplayVersion
    }
    if ($sw) { [PSCustomObject]@{Computer=$c; Product=$sw.DisplayName; Version=$sw.DisplayVersion} }
  } catch { Write-Warning "Unreachable: $c" }
}
# Export and reconcile against the fixed version in the BeyondTrust advisory; flag anything older.