Today's briefing covers three CISA items: active exploitation of CVE-2026-102764, an authentication bypass in BeyondTrust Remote Support that CISA added to the Known Exploited Vulnerabilities catalog on 2026-10-16; the same-day KEV addition of CVE-2025-61624, a Fortinet path traversal whose federal due date is 2026-10-19; and the updated advisory ICSA-26-280-01 for seven CVEs in Malcolm, the CISA-maintained platform that processes captured network traffic and logs. The first two are being exploited now; the third has fixes and no reported exploitation, but its flaws reach the defender's own monitoring data.
CISA says it is aware of a critical authentication bypass, CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier, and that cyber threat actors are actively exploiting it to gain initial access, then establish persistence, escalate privileges and move laterally. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-10-16. Patches are available for supported versions, 24.3.1 and later: operators of self-hosted appliances should apply the BT26-05-RS patch described in BeyondTrust's Security Advisory BT26-05, and appliances on a version older than 24.3.1 must be upgraded before the patch can be applied. BeyondTrust-hosted (SaaS) Remote Support deployments have already been patched.
CISA also asks operators to limit external access to the appliance to the services needed to support users and customers, restrict administrative interfaces to trusted networks, and conduct network and memory forensics on affected self-hosted appliances. Where compromise is suspected, the alert lists the steps: isolate the appliance; take a snapshot of virtual appliances or a forensic image of physical ones; immediately forward appliance syslog and session events to the SIEM; and collect web application firewall, reverse-proxy or perimeter firewall logs for the exposure window. Hunt for unrecognized privileged or administrative sessions, unrecognized script files, unexpected gaps in logs or log forwarding, and unauthorized account, permission or session-policy changes. Recovery means rebuilding from a known-good state, applying the patch, rotating every credential the appliance stored or injected, revoking all active support sessions and reviewing new multifactor authentication registrations on privileged accounts.
A remote-support appliance holds credentials it stores or injects, which is why CISA's recovery steps end with rotating all of them, and CISA describes exploitation that already goes past initial access to persistence and lateral movement. Self-hosted operators should patch now, upgrading first if they run a version below 24.3.1, and should not treat the patch as the end of the response: run the forensic checks CISA lists, and if anything turns up, rebuild from a known-good state, rotate every stored or injected credential and revoke open support sessions. SaaS deployments were patched by BeyondTrust; CISA's forensic guidance is addressed to self-hosted appliances.
CISA added CVE-2025-61624 to the Known Exploited Vulnerabilities catalog on 2026-10-16. The catalog entry describes a path traversal vulnerability in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager that may allow an authenticated attacker with an admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. The required action is to apply mitigations in accordance with vendor instructions, in compliance with Binding Operational Directive (BOD) 26-04, Prioritizing Security Updates Based on Risk, and CISA's Forensics Triage Requirements, and to follow BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. The entry makes stakeholders responsible for evaluating each asset's internet exposure. The due date is 2026-10-19, three days after the addition, and known ransomware campaign use is listed as unknown.
Exploitation needs an authenticated administrator with read-write permissions, so exposure turns on who holds admin profiles on these devices and how those accounts are protected; the KEV listing means the flaw is being used regardless. Operators of FortiOS, FortiPAM, FortiProxy or FortiSwitchManager should apply Fortinet's mitigations now, review which accounts hold admin profiles with read-write permissions, and, in line with the forensic-triage requirement attached to the entry, check affected devices for unexpected file writes or deletions.
CISA's advisory for Malcolm, which it lists as the vendor, covers seven CVEs across six weakness classes with a headline CVSS v3 score of 8.1. Five affect Malcolm v26.07.1 and earlier and were fixed in v26.08.0; CVE-2026-107333 and CVE-2026-107362 also affect v26.08.0 and were fixed in v26.09.0. The advisory was first published on 2026-10-07 and updated on 2026-10-15; it lists the Energy, Information Technology, and Water and Wastewater Systems sectors, with worldwide deployment. Seth Grover of Idaho National Laboratory reported the vulnerabilities, and CISA says no known public exploitation specifically targeting them has been reported.
Four flaws undermine authentication or authorization. In CVE-2026-107336 (CVSS v3.1 6.5), the nginx front proxy's Dashboards-to-Arkime shortcut matches paths case-insensitively but rewrites them case-sensitively, so a non-lowercase path such as /IDDASH2ARK/ falls through to the Arkime backend via the one proxied location without the per-location authentication file, carrying a client-supplied X-Forwarded-User header that Arkime trusts as the authenticated username. CVE-2026-107333 (8.1) and CVE-2026-107334 (5.4) both exploit disagreement between Malcolm's Lua role-based access control layer and nginx routing: a path-normalization inconsistency in the first, and a check on the raw percent-encoded URI in the second, so an authenticated low-privilege user can reach admin-only paths such as /%68tadmin.php. CVE-2026-107361 (4.2) exposes the Arkime live-capture service on port 8005 on all interfaces, trusting X-Forwarded-User from any IP address with a passwordSecret hard-coded to the public value "Malcolm", so a network-adjacent attacker can bypass nginx entirely with a forged identity header.
Three more hit integrity and availability. CVE-2026-107362 (7.1) ships the upstream FilePond PHP server largely unmodified, including a fetch route that downloads an arbitrary URL with curl and lets the caller read the fetched content back, a server-side request forgery. CVE-2026-107337 (7.1) is a cross-site request forgery: the kiosk Flask application's POST /script_call/ endpoint has no authentication and wildcard CORS, so an attacker can make the operator's browser run management commands, including control.py --wipe, which permanently deletes all captured network traffic and forensic logs, or control.py --stop, which blinds monitoring. CVE-2026-107335 (6.5) applies extraction limits to archives but not to single-stream compressed uploads such as .gz or .xz, so any user allowed to upload PCAP or log files can exhaust the shared Docker volume used by OpenSearch, Logstash, Arkime and Zeek with a decompression bomb.
These bugs sit in a monitoring tool, so they target the defender's own visibility: one forged request from a browser can wipe captured traffic and forensic logs or stop monitoring, and several paths hand an unauthenticated or low-privilege caller an identity or an admin route. Move to v26.09.0, the release the advisory lists for CVE-2026-107333 and CVE-2026-107362 (the other five were fixed in v26.08.0). Until then, keep Malcolm's interfaces, including port 8005, reachable only from trusted analyst networks, and follow CISA's standing advice to keep control-system networks off the internet and behind firewalls isolated from business networks.
