CISA added two vulnerabilities to the Known Exploited Vulnerabilities catalog on July 27, 2026, both with evidence of active exploitation. They sit at opposite ends of the severity scale and the more dangerous one is not the ten.

CVE-2026-16812: Arista VeloCloud Orchestrator, CVSS 10.0

CVE-2026-16812 is an unauthenticated OS command injection in Arista VeloCloud Orchestrator, scoring a perfect 10.0. A remote attacker with no credentials can reach privileged functionality intended only for internal use and execute arbitrary operating system commands on the orchestrator host. The outcome is full compromise of the orchestrator and every SD-WAN deployment it manages. It was exploited as a zero-day before Arista shipped a patch.

Perfect-10 scores get discounted through overuse, so it is worth being precise about why this one earns it. VeloCloud Orchestrator is not an edge device — it is the management plane for the edges. It holds the configuration, the tunnel keys, the routing policy, and the push mechanism for every SD-WAN appliance in the estate.

Compromising it does not get an attacker onto one branch network. It gets them the ability to reconfigure the WAN: reroute traffic through infrastructure they control, alter or disable inspection policy, push configuration to every managed edge simultaneously, and read the topology of every site the organisation operates. It is the closest thing to a master key that enterprise networking offers, and organisations running VeloCloud are disproportionately large multi-site enterprises, service providers, and managed network operators — meaning one orchestrator can front a great many downstream customers.

CISA invoked BOD 26-04 and gave federal civilian agencies three days to patch. Three-day deadlines are not routine; the standard KEV remediation window is measured in weeks. That timeline is the agency’s own assessment of how bad this is.

CVE-2025-68686: The FortiOS Flaw That Looks Harmless

CVE-2025-68686 carries a CVSS score of 5.3 — medium. It is a bypass in FortiOS SSL-VPN of a security patch that was designed to prevent the persistence of malicious symbolic links. It cannot be exploited on its own; an attacker must already have filesystem-level access to the appliance through some other vulnerability.

Read that as a dependency, not as mitigation.

The context is the campaign in which attackers who had compromised FortiGate appliances planted symbolic links inside the SSL-VPN language file directory, linking back to the device root filesystem. Because those links lived in a location that survived patching, operators who dutifully applied every subsequent Fortinet update — and even those who rotated credentials — remained readable to the attacker. Fortinet shipped a fix specifically to strip and block that persistence.

CVE-2025-68686 defeats that fix. It restores the ability of an attacker who already has a foothold to survive the remediation the vendor built for exactly this problem.

CVSS is scoring the wrong thing here. A 5.3 that requires prior access looks trivial next to a 10.0. But the population at risk is precisely the set of organisations that were compromised, were told they were compromised, and did the remediation they were instructed to do. Those organisations now believe they are clean. Some of them are not.

The Pattern Neither CVE Escapes

Both flaws are in network edge and management infrastructure, and this is where intrusion has been concentrating for years — Ivanti Connect Secure, Citrix NetScaler, Palo Alto GlobalProtect, Cisco ASA, SonicWall, Fortinet repeatedly.

The reasons are structural and unlikely to change:

  • These devices are internet-facing by design. There is no network segmentation argument to make about a VPN concentrator.
  • They cannot run EDR. They are appliances, so defenders have vendor logs and nothing else.
  • They hold or broker credentials — VPN sessions, certificates, management access.
  • They are patched slowly, because taking down the VPN or the SD-WAN controller means taking down remote access for the whole company, which means a change window, which means weeks.
  • Their logging is thin, and forensics after a compromise is frequently inconclusive.

An attacker who takes a VeloCloud Orchestrator or a FortiGate is inside the trust boundary, invisible to the endpoint tooling the SOC actually watches, and positioned to move laterally with legitimate credentials.

What to Do

If you run Arista VeloCloud Orchestrator: patch now, and treat any unpatched internet-exposed instance as compromised until proven otherwise. This was exploited as a zero-day, so patching closes the door on a house someone may already be inside. Review orchestrator audit logs for unexpected configuration pushes, examine every managed edge configuration against a known-good baseline, and rotate orchestrator credentials and API tokens. Remove management-plane exposure from the public internet entirely.

If you run FortiOS SSL-VPN: patch, then hunt. Specifically inspect the SSL-VPN language file directory and the wider filesystem for unexpected symbolic links, and compare against a clean build rather than trusting the appliance’s own reporting. If your organisation was affected by the earlier FortiGate symlink persistence campaign and considers that incident closed, reopen it. That is the entire population this CVE was written for.

Generally: the management planes for network infrastructure — SD-WAN controllers, wireless controllers, firewall managers, VPN concentrators — should not be reachable from the internet. Every one of these incidents starts with a device that was.

Sources