Good morning. Arista confirmed that attackers used a CVSS 10.0 bug in on-premises VeloCloud Orchestrator before a fix existed, and CISA wants federal systems patched by July 30. After that: July's record Patch Tuesday, a Microsoft AI benchmark claim and two new KEV entries.
Lead Story
Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw
Arista has confirmed that attackers exploited CVE-2026-16812 (CVSS 10.0), an OS command injection flaw in on-premises VeloCloud Orchestrator, before a fix was available. Fixed releases are 5.2.3.14, 6.1.3.4, 6.4.2.4 and 7.0.0.1; Hosted and Dedicated deployments were patched in advance, and Gateways and Edges are not affected.
Why it matters: The orchestrator manages the whole SD-WAN, so one compromised server reaches every site it controls. CISA set a July 30 deadline for federal agencies.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Read more on CyberExperts: Read more on CyberExperts
Original source: The Hacker News
Recommended action: Upgrade on-premises orchestrators, limit management access, and search for the indicator IPs 8.19.75.217, 206.72.242.124 and 206.72.242.162.
Also Worth Your Attention
Arista patches VeloCloud Orchestrator zero-day exploited in attacks
BleepingComputer’s report on the same zero-day covers Arista’s fixed releases for the affected 5.2.x, 6.1.x, 6.4.x and 7.0.x lines of on-premises VeloCloud Orchestrator.
Why it matters: Arista patched Hosted and Dedicated deployments in advance. Anyone running VCO on-premises has to install the fix themselves.
Read more on CyberExperts: Read more on CyberExperts
Original source: BleepingComputer
Recommended action: Confirm deployment type for every orchestrator before closing the ticket.
Begun, the Patch Wars have
In Talos’s Threat Source newsletter, Joe Marshall looks at July’s record Microsoft Patch Tuesday: 622 vulnerabilities, 62 rated critical and three zero-days, two of them actively exploited. Microsoft attributes the surge to AI-accelerated research. The issue also covers UAT-11795, a Russian-speaking group using trojanized Webex, Zoom and MobaXterm installers to deliver “Starland RAT.”
Why it matters: If 600-plus fixes in a month becomes normal, change processes built for a much smaller load will fall behind. Vendors with fewer resources may also ship fixes more slowly.
Read more on CyberExperts: Read more on CyberExperts
Original source: Cisco Talos
Recommended action: Review whether test-and-deploy cycles can absorb larger monthly releases, and prioritize by exploitation status and KEV listing.
Microsoft Says New Cybersecurity AI Model Helps MDASH Score 95.95% at Half the Cost
Microsoft says MDASH, its multi-model vulnerability-finding system, scored 95.95% on CyberGym using its new MAI-Cyber-1-Flash model alongside GPT-5.4, at about half the cost of its previous best model mix. The model is available only inside MDASH through an Azure AI Foundry private preview.
Why it matters: The 95.95% belongs to the whole MDASH setup, with GPT-5.4 in the mix. CyberGym Level 1 tests whether a tool can reproduce known vulnerabilities. It does not test finding new ones or writing correct patches.
Read more on CyberExperts: Read more on CyberExperts
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Original source: The Hacker News
Recommended action: Before a vendor's AI benchmark shapes a tooling decision, ask what was measured and how.
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added Fortinet FortiOS CVE-2025-68686 and Arista VeloCloud Orchestrator CVE-2026-16812 to the KEV catalog on July 27. The FortiOS flaw lets attackers bypass the fix for the SSL-VPN symlink persistence mechanism on devices already compromised at file-system level.
Why it matters: Both bugs sit on network gear. The FortiOS entry is about attackers keeping access to devices they already broke into.
Read more on CyberExperts: Read more on CyberExperts
Original source: CISA
Recommended action: Upgrade FortiOS to 7.6.2 or 7.4.7 or later (or migrate older branches) and patch on-premises VeloCloud Orchestrators.
Go Deeper
The Daily Brief covers the patches and incidents worth acting on, in about five minutes.
Get the Daily Brief every weekday morning.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Friday’s brief: Cisco VPN firewalls under attack, then GitLab, Synology NAS ransomware and Cisco SD-WAN spyware
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
