Vulnerability intelligence

CVE-2026-102764 is an improper origin validation vulnerability affecting the internal messaging components of BeyondTrust Remote Support (formerly Bomgar) appliances. The flaw impacts all supported versions of the software up to and including 26.2.3. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability to perform arbitrary file operations on the appliance. This capability can allow attackers to gain host-level control, escalate privileges to root, and access credentials stored or brokered by the system. The vulnerability was exploited as a zero-day starting in late August 2026 by a suspected China-nexus cyber espionage group tracked as Armory Castle (formerly UNC5221). During these intrusions, the threat actors deployed custom backdoors, such as the SAWFLY web shell and BARECLAW tunneler, to maintain persistence and harvest credentials. BeyondTrust released patches on October 9, 2026, which were automatically deployed to SaaS customers, while self-hosted customers running versions 24.3.1 through 26.2.3 are advised to manually apply the BT26-05-RS update. The Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities catalog.

CVE-2025-61624 is a path traversal vulnerability (CWE-22) affecting the command line interpreter (CLI) of several Fortinet products, including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. The flaw stems from improper input validation, specifically involving unsanitized `system.auto-script` object names. This allows an authenticated attacker with administrative privileges and read-write permissions to escape restricted directories and write or delete arbitrary files on the underlying filesystem by executing crafted CLI commands. In real-world attacks, threat actors have exploited this vulnerability as a privilege-escalation vector to transition from restricted administrative access to root-level control over the underlying operating system. This exploit has been used in the wild to deploy PEERSTITCH, a stealthy, memory-resident ARM64 malware designed to evade traditional file-based detection. Fortinet addressed the vulnerability in April 2026, releasing patches for affected versions of FortiOS and other impacted products.

An analysis of popular cybersecurity articles and official advisories indicates that **CVE-2026-61624** is a Server-Side Request Forgery (SSRF) vulnerability. The flaw is classified under CWE-918 and is associated with the handling of remote requests. *(Note: If you are referring to the widely reported Fortinet path traversal vulnerability that was actively exploited in late 2026 to deploy the PEERSTITCH malware, that flaw is tracked under **CVE-2025-61624**. It allows authenticated administrators with read-write permissions to write or delete arbitrary files on the underlying filesystem via crafted CLI requests.)*

CVE-2026-102764 is an improper origin validation vulnerability affecting the internal messaging components of BeyondTrust Remote Support (formerly Bomgar) appliances. The flaw impacts all supported versions of the software up to and including 26.2.3. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability to perform arbitrary file operations on the appliance. This capability can allow attackers to gain host-level control, escalate privileges to root, and access credentials stored or brokered by the system. The vulnerability was exploited as a zero-day starting in late August 2026 by a suspected China-nexus cyber espionage group tracked as Armory Castle (formerly UNC5221). During these intrusions, the threat actors deployed custom backdoors, such as the SAWFLY web shell and BARECLAW tunneler, to maintain persistence and harvest credentials. BeyondTrust released patches on October 9, 2026, which were automatically deployed to SaaS customers, while self-hosted customers running versions 24.3.1 through 26.2.3 are advised to manually apply the BT26-05-RS update. The Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities catalog.

CVE-2025-61624 is a path traversal vulnerability (CWE-22) affecting the command line interpreter (CLI) of several Fortinet products, including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. The flaw stems from improper input validation, specifically involving unsanitized `system.auto-script` object names. This allows an authenticated attacker with administrative privileges and read-write permissions to escape restricted directories and write or delete arbitrary files on the underlying filesystem by executing crafted CLI commands. In real-world attacks, threat actors have exploited this vulnerability as a privilege-escalation vector to transition from restricted administrative access to root-level control over the underlying operating system. This exploit has been used in the wild to deploy PEERSTITCH, a stealthy, memory-resident ARM64 malware designed to evade traditional file-based detection. Fortinet addressed the vulnerability in April 2026, releasing patches for affected versions of FortiOS and other impacted products.

CVE-2026-21589 is a path traversal and arbitrary file access vulnerability that affects multiple self-hosted Atlassian Data Center and Server products, including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. The flaw allows remote, unauthenticated attackers to access specific files within the web application's root directory. To successfully exploit the vulnerability, an attacker must know the exact name and path of the target file, as the flaw does not allow directory listing or file enumeration. The vulnerability impacts all versions of the affected products prior to their designated fixed releases. While Atlassian's cloud-based services are secure and require no action, organizations utilizing self-hosted deployments are advised to upgrade to the patched versions. For systems that cannot be immediately updated, recommended mitigations include taking internet-facing instances offline, deploying web application firewall (WAF) rules, or configuring URL rewriting rules to block directory traversal attempts containing double-dot (`../`) sequences.