Observed Signal · Jul 28, 2026 · Security Advisory · Source: DEV Community · Impact: 4/5 · Sentiment: Negative
Critical Arista VeloCloud Orchestrator RCE (CVE-2026-16812)
Arista disclosed CVE-2026-16812, a CVSS 10.0 operating-system command injection in on-premises VeloCloud Orchestrator (VCO) that is being actively exploited. Successful exploitation can give remote attackers privileged control of the orchestrator and potentially the VeloCloud Edge devices it manages. Arista published fixed on-prem builds (5.2.3.14, 6.1.3.4, 6.4.2.4, 7.0.0.1), advised network blocks for three IoC IPs (8.19.75.217, 206.72.242.124, 206.72.242.162), and recommended restricting VCO web access and preserving logs for forensic analysis. CISA added the flaw to its Known Exploited Vulnerabilities catalog with a July 30, 2026 FCEB patch deadline. The article also notes related KEV additions for Fortinet FortiOS (CVE-2025-68686) and Alibaba Fastjson (CVE-2026-16723).
CVSS 10.0 remote command injection actively exploited, affects SD-WAN management plane with potential network-wide impact; added to CISA KEV with an FCEB patch deadline, making it high-priority for enterprises and government.
Track Fortinet Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Arista disclosed CVE-2026-16812, a CVSS 10.0 OS command injection in on-premises VeloCloud Orchestrator.
- The vulnerability was publicly reported and already under active exploitation as of Arista's advisory published July 27, 2026.
- Arista released fixed on-prem VCO builds: 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1; hosted and dedicated instances were already patched by Arista.
- CISA added CVE-2026-16812 to the Known Exploited Vulnerabilities catalog and set a July 30, 2026 remediation deadline for Federal Civilian Executive Branch agencies.
- Arista published three IoC source IPs to block and hunt for: 8.19.75.217, 206.72.242.124, and 206.72.242.162.
Connected Companies & Entities
2 Entities mapped“CISA added a second entry alongside the Arista flaw: CVE-2025-68686, a medium-severity information exposure issue in Fortinet FortiOS, CVSS ...”
“Separately, CVE-2026-16723 in Alibaba's Fastjson library, CVSS 9.0, is under attack and remains unpatched....”
Ontology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Cisco patches CVSS 10.0 Secure Workload authentication bypass
Cisco released emergency patches addressing a maximum-severity authentication-bypass vulnerability in its Secure Workload platform (tracked as CVE-2026-20223) that earned a CVSS 10.0 score. The flaw allows unauthenticated remote attackers to gain Site Admin privileges by sending specially crafted requests to Secure Workload's REST API, bypassing authentication. The vulnerability affects both SaaS-hosted and on-premises deployments, can enable cross-tenant access to sensitive telemetry and configuration, and has no known workaround — Cisco recommends applying the fixes immediately. Security publishers noted this is one of several 'perfect 10' bugs disclosed for Cisco in 2026 and emphasized the broad impact on enterprises that use Secure Workload as part of zero-trust and micro-segmentation architectures.
Critical Cisco Bug Exploited Since 2023, Global Alert Issued
Cisco disclosed a critical vulnerability (CVSS 10.0) in its Catalyst SD‑WAN product family that allows remote attackers to gain full, persistent privileged access to affected devices. Cisco’s researchers found evidence of exploitation dating back to 2023, and some impacted organizations are described as critical infrastructure. Governments including Australia, Canada, New Zealand, the United Kingdom and the United States issued warnings; U.S. agency CISA ordered civilian federal agencies to patch by the end of the specified Friday citing imminent threat. Cisco and governments did not publicly attribute the attacks to a named threat actor, though Cisco tracked a cluster of activity as UAT‑8616. The disclosure follows a December advisory for another actively exploited Cisco vulnerability in Async software.
FortiOS CVE-2025-68686 Symlink Mitigation Bypass
CVE-2025-68686 is an actively exploited FortiOS vulnerability that allows attackers who already have file-system access to bypass symlink persistence mitigations via crafted HTTP requests to the SSL‑VPN web interface. The flaw can expose sensitive files (configurations, credentials, keys) even after firmware upgrades. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on July 27, 2026. Affected FortiOS versions include 6.4, 7.0, 7.2, 7.4.0–7.4.6 and 7.6.0–7.6.1; vendor fixes are available in 7.4.7, 7.6.2 or later. Successful exploitation requires a prior file‑system compromise; remediation guidance includes rebuilding devices, removing artifacts, rotating secrets, and restricting SSL‑VPN exposure.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.