What Changed
On July 27, CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation: CVE-2025-68686 in Fortinet FortiOS and CVE-2026-16812 in Arista VeloCloud Orchestrator. Both fall under BOD 26-04 remediation requirements for federal civilian agencies.
FortiOS (CVE-2025-68686)
Fortinet’s advisory FG-IR-25-934, first published February 10, 2026, describes an information exposure flaw in FortiOS SSL-VPN that lets a remote, unauthenticated attacker bypass the patch Fortinet built for the symbolic-link persistence mechanism seen after earlier compromises. It can only be abused on devices an attacker already compromised at file-system level through another vulnerability. Fixed versions are 7.6.2 and 7.4.7 or later; 7.2, 7.0 and 6.4 users must migrate to a fixed release. Devices that never had SSL-VPN enabled are not affected.
Arista VeloCloud Orchestrator (CVE-2026-16812)
This CVSS 10.0 OS command injection flaw in on-premises VCO was exploited as a zero-day. Fixed releases are 5.2.3.14, 6.1.3.4, 6.4.2.4 and 7.0.0.1. The federal deadline is July 30.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What To Verify First
- Upgrade FortiGate devices on 7.6.0–7.6.1 or 7.4.0–7.4.6, and plan migration for older branches.
- Treat any FortiGate with past compromise indicators as suspect: the FortiOS entry is about attackers keeping access, not getting in.
- Upgrade on-premises VeloCloud Orchestrators and restrict their management exposure.
What Teams May Be Underestimating
The FortiOS listing is a persistence warning. A device that was patched after an earlier breach may still give an attacker read access unless it is on a fixed build.
Both entries also sit on network infrastructure that is often managed by a different team than servers and endpoints. Make sure the KEV notice actually reaches the owners of firewalls and SD-WAN controllers.
Source Context
This item was rebuilt from the following primary sources and original reporting:
- CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (July 27, 2026)
- Fortinet PSIRT: FG-IR-25-934
- The Hacker News: Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
