Perimeter Risk Alert: CISA Adds Arista VeloCloud RCE and Fortinet FortiOS Flaws to KEV Catalog
Executive Summary
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency alert adding two critical, actively exploited edge infrastructure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The additions include CVE-2026-16812, an unauthenticated remote OS command injection flaw in on-premises Arista VeloCloud Orchestrator SD-WAN management appliances, and CVE-2025-68686, a sensitive information disclosure vulnerability affecting Fortinet FortiOS. Federal civilian agencies and enterprise network operators must remediate these perimeter vulnerabilities immediately under binding operational directives.
Technical Breakdown of the Exploited Vulnerability Vectors
Both vulnerabilities target internet-facing perimeter devices that serve as central administration nodes for enterprise networks:
1. Arista VeloCloud Orchestrator Command Injection (CVE-2026-16812)
The vulnerability resides in the web-based management API of on-premises Arista VeloCloud Orchestrator deployments:
* The Mechanism: An unauthenticated, network-positioned attacker transmits malformed JSON payloads containing shell metacharacters to un-sanitized API endpoints on port 443/8443.
* The Exploitation: The backend service fails to validate input parameters before executing system diagnostic scripts, allowing the attacker to run arbitrary OS commands with root privileges.
* Impact: Unauthenticated attackers gain total control over the SD-WAN controller, enabling them to re-route enterprise site-to-site traffic, deploy persistent backdoors, and intercept unencrypted transit data.
2. Fortinet FortiOS Sensitive Information Disclosure (CVE-2025-68686)
The flaw impacts the FortiOS administration daemon and SSL-VPN process handling:
* The Flaw: Improper memory boundary validation permits unauthorized remote actors to read un-allocated system memory blocks via specifically crafted HTTP requests.
* The Exploitation: Active in-the-wild exploitation reveals that threat actors extract cleartext administrative session tokens, active SSL-VPN user credentials, and internal network configuration files.
* Impact: Extracted credentials allow threat actors to bypass perimeter firewalls and log in directly as legitimate system administrators without triggering brute-force alarms.
Advisory Metric
Detail
Advisory Agency
Cybersecurity and Infrastructure Security Agency (CISA)
Vulnerabilities Added
CVE-2026-16812 (Arista VeloCloud) & CVE-2025-68686 (Fortinet FortiOS)
CVSS Scores
9.8 (Critical - Arista) / 7.5 (High - Fortinet)
Exploitation Status
Active In-The-Wild Exploitation Confirmed
Compliance Requirement
Mandatory Federal Remediation Under BOD 22-01
Critical Systemic Risks to Enterprise SD-WAN and Edge Networks
The targeting of SD-WAN orchestrators and VPN gateways represents an aggressive shift toward network infrastructure hijacking. Centralized SD-WAN controllers like Arista VeloCloud orchestrate routing policy, encryption tunnels, and firewall rules across thousands of remote branch offices.
When a SD-WAN orchestrator is compromised, defenders lose visibility into cross-site transit traffic, allowing adversaries to silently pivot laterally across the entire enterprise WAN.
Recommendations and Mitigations
Organizations operating Arista VeloCloud or Fortinet FortiOS infrastructure must take immediate protective measures:
1. Apply Vendor Security Patches: Immediately upgrade Arista VeloCloud Orchestrator to fixed software builds and install FortiOS maintenance releases.
2. Restrict Management Portal Reachability: Remove all SD-WAN orchestrator and firewall administrative web interfaces from direct public internet exposure. Restrict management access to out-of-band management VLANs or IPsec tunnels.
3. Audit Active Admin Sessions & VPN Logs: Review historical authentication logs for abnormal administrative logins originating from non-standard external IP addresses.
4. Enforce Hardware-Based MFA: Require FIDO2 WebAuthn security keys for all remote administrative access to network security appliances.