Loading story…
CISA updated its Known Exploited Vulnerabilities catalog to add CVE-2026-16812, a critical CVSS 10.0 OS command injection flaw in Arista VeloCloud Orchestrator On-Prem, and reporting also identified the addition of CVE-2025-68686 in Fortinet FortiOS. The Arista issue can expose privileged internal functionality and allow remote compromise of the underlying orchestrator host, affecting the confidentiality, integrity, and availability of the platform and managed data. VMware and Arista said the VeloCloud vulnerability is being actively exploited in the wild.
The Fortinet flaw is an information disclosure issue that can be abused by an attacker who already has filesystem-level access to bypass symbolic-link protections and continue accessing sensitive resources. CISA directed agencies to apply vendor mitigations and follow Binding Operational Directive requirements on accelerated timelines, while defenders were urged to identify exposed deployments, patch affected systems immediately, review logs for signs of compromise, and prioritize internet-facing management infrastructure tied to KEV-listed vulnerabilities.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
CISA's Known Exploited Vulnerabilities catalog was updated to add CVE-2026-16812, an Arista VeloCloud Orchestrator On-Prem OS command injection flaw. The catalog total increased from 1654 to 1655 entries, and CISA noted the vulnerability could compromise the confidentiality, integrity, and availability of the orchestrator and its managed data.
Subsequent reporting stated that CISA added two actively exploited vulnerabilities to the KEV catalog: CVE-2026-16812 in Arista VeloCloud Orchestrator and CVE-2025-68686 in Fortinet FortiOS. The reports also said VMware and Arista confirmed active exploitation of the VeloCloud flaw in the wild.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcesecurityaffairs.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA expanded its Known Exploited Vulnerabilities catalog in a series of June updates, adding four newly exploited issues across enterprise and software platforms. The agency first listed **CVE-2026-45247** in Mirasvit Full Page Cache Warmer, a deserialization flaw that can enable unauthenticated remote code execution through a crafted serialized PHP object in the `CacheWarmer` cookie. It then added **CVE-2026-42271** in BerriAI LiteLLM, a command injection bug that can let any authenticated user, including low-privilege internal-user key holders, execute arbitrary commands on the host. CISA directed organizations to apply vendor mitigations, follow **BOD 22-01** guidance for cloud services, or discontinue use if mitigations are unavailable. CISA later added three more exploited vulnerabilities: a **Google Chromium V8** out-of-bounds read/write flaw that could allow sandboxed remote code execution via a crafted HTML page, an **Arista EOS** packet decapsulation vulnerability, and a **Cisco Catalyst SD-WAN Manager** flaw that could allow an authenticated local attacker to execute arbitrary commands as root. The KEV catalog count rose from **1,610** to **1,617** across the updates, and CISA assigned remediation deadlines ranging from **2026-06-06** to **2026-06-23**. Separate GitHub commits also showed Rack maintainers fixing multipart parsing denial-of-service issues tracked as **CVE-2025-61770**, **CVE-2025-61771**, and **CVE-2025-61772**, but those fixes were not part of the KEV additions described in the June catalog changes.
Jun 29, 2026
Arista Networks released urgent fixes for **CVE-2026-93952**, a CVSS 10.0 improper-input-validation flaw in on-premises VeloCloud Orchestrator (VCO) that has been exploited as a zero-day. An attacker with network access to the VCO web interface and the public portion of a VeloCloud Edge authentication certificate can reach privileged internal functionality without tenant or operator credentials, potentially compromising the confidentiality, integrity, and availability of the orchestrator and managed data. Affected versions include VCO 5.2.0–5.2.3.15, 6.1.0–6.1.3.7, 6.4.0–6.4.2.7, and 7.0.0–7.0.0.2; fixes are available in 5.2.3.16 and 6.4.2.8, with other release-train patches pending. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring U.S. federal agencies to remediate within three days. Administrators should apply Arista updates immediately and investigate VCO hosts for published indicators, including malicious files, a `vc-sysmond` implant, unauthorized systemd services, and suspicious source IPs in nginx logs. Rapid7 has proposed detection-only Metasploit modules to fingerprint potentially affected VCO interfaces and conduct local read-only IOC checks; the project cautions that a favicon can identify VCO but cannot reliably establish its version remotely, and exploitation also requires Edge-to-VCO certificate material.
Sep 23, 2026
Arista has disclosed and patched **CVE-2026-16812**, a maximum-severity OS command injection flaw in **VeloCloud Orchestrator (VCO) On-Prem** that is being actively exploited in the wild. The vulnerability lets a remote, unauthenticated attacker with network access to the VCO web interface reach privileged internal functionality that was intended only for internal use, potentially compromising the confidentiality, integrity, and availability of the orchestrator and the data it manages. The issue is tracked as **`CWE-78`** and carries a **CVSS 3.1** score reflecting complete impact across all three security pillars. Affected releases include **5.2.x before 5.2.3.14**, **6.1.x before 6.1.3.4**, **6.4.x before 6.4.2.4**, and **7.0.x before 7.0.0.1**. Arista said its **Hosted** and **Dedicated** VCO deployments were patched before public disclosure and are not affected, but warned that patching alone may not be enough if an instance was already compromised because attackers could also gain access to managed **VeloCloud Edge** devices. **CISA** has added the flaw to its **Known Exploited Vulnerabilities** catalog and directed U.S. federal civilian agencies to remediate it by **July 30, 2026**, while Arista has published indicators of compromise to support incident response.
Jul 29, 2026