CISA Urges Immediate Action: Arista VeloCloud and Fortinet Zero-Days Added to KEV Catalog
Executive Summary
On July 27, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) officially added two critical, actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog (CISA Alert - July 27, 2026). The additions comprise an unauthenticated command injection vulnerability in on-premises Arista VeloCloud Orchestrator (CVE-2026-16812) and an information disclosure vulnerability in Fortinet FortiOS (CVE-2025-68686). Both vulnerabilities are undergoing active in-the-wild exploitation by sophisticated threat actors targeting edge networking and SD-WAN infrastructure. In response, CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies patch these systems immediately under Binding Operational Directive (BOD) 26-04.
Deep-Dive Technical Analysis
1. Arista VeloCloud Orchestrator Unauthenticated OS Command Injection (CVE-2026-16812)
Arista VeloCloud Orchestrator serves as the central control plane for managing Software-Defined Wide Area Network (SD-WAN) deployments. CVE-2026-16812 stems from improper input validation within pre-authentication management endpoints. An unauthenticated remote attacker can submit specially crafted HTTP API requests containing shell metacharacters to exposed management interfaces.
When processed by the underlying web service, these unsanitized inputs are concatenated into operating system command strings and executed with root-level privileges (root). This affords attackers complete control over the Orchestrator, enabling them to:
* Intercept and modify SD-WAN routing policies across enterprise branches.
* Extract cryptographic tunnel keys and tenant management credentials.
* Deploy persistent web shells and pivot laterally into internal corporate networks.
2. Fortinet FortiOS Information Disclosure Vulnerability (CVE-2025-68686)
Fortinet FortiOS powers FortiGate next-generation firewalls and SSL-VPN appliances. CVE-2025-68686 is an information disclosure vulnerability caused by improper access control and bounds checking within administrative web services.
Unauthenticated remote attackers can query specific web handlers to trigger memory overreads or bypass authorization barriers, leaking sensitive operational data from server process memory. The disclosed information includes:
* Administrative session tokens and active user cookie parameters.
* Plaintext configuration files containing hashed or encrypted passwords.
* Internal network topology details and routing tables.
Threat actors frequently chain information disclosure flaws like CVE-2025-68686 with administrative or privilege escalation vectors to achieve full device takeover without needing brute-force password attempts.
Federal Mandates and Perimeter Threat Modeling
CISA BOD 26-04 Compliance
Under Binding Operational Directive (BOD) 26-04, federal agencies are required to remediate KEV catalog additions according to strict timelines (CISA KEV Catalog). Given the critical role SD-WAN orchestrators and perimeter firewalls play in national security infrastructure, federal networks face an accelerated compliance deadline to mitigate both flaws.
Targeting Edge and SD-WAN Infrastructure
The addition of these two vulnerabilities highlights a deliberate trend among advanced persistent threat (APT) groups: prioritizing edge networking devices over traditional endpoints. Edge devices and SD-WAN management portals are ideal targets because:
1. They sit directly on the internet perimeter with open management ports.
2. They often lack endpoint detection and response (EDR) agent capabilities.
3. Compromising the SD-WAN management plane grants centralized visibility over all connected remote branch offices and cloud tunnels.
Industry Impact and Actionable Mitigations
1. Immediate Software Upgrades
* Arista VeloCloud Orchestrator: Enterprise administrators using on-premises VeloCloud Orchestrator deployments must apply the latest security updates released by Arista immediately. Cloud-managed VeloCloud instances managed directly by Arista have been updated automatically, but self-hosted installations require urgent manual patching.
* Fortinet FortiOS: System administrators running affected FortiOS versions should update firmware to the latest patched releases according to Fortinet security advisories.
2. Management Access Restrictions
* Disable Public Management Access: Restrict all access to Arista VeloCloud Orchestrator and Fortinet FortiOS administrative interfaces from the public internet.
* Enforce Out-of-Band & VPN Management: Require dedicated, authenticated administrative VPNs or out-of-band management networks (with IP whitelisting and phishing-resistant FIDO2 MFA) for accessing management consoles.
3. Compromise Auditing & Token Revocation
* Session Termination: Following patch installation, force the termination and regeneration of all active administrative session tokens and API keys.
* Log Inspection: Review web server and system logs on VeloCloud Orchestrators and FortiOS appliances for anomalous HTTP POST/GET requests, unusual process spawns, or unauthorized administrative log-ins preceding the patch window.
Sources & References:
* CISA Adds Two Known Exploited Vulnerabilities to Catalog — July 27, 2026