CISA Adds Two Exploited Vulnerabilities to KEV — Arista VeloCloud (CVSS 10.0) and Fortinet FortiOS

CISA placed CVE-2026-16812 and CVE-2025-68686 on the KEV catalog on July 27, 2026, citing evidence of active exploitation for both. The Arista bug is an unauthenticated OS command injection, CWE-78, in VeloCloud Orchestrator on-prem, scored 10.0 under both CVSSv3.1 and CVSSv4.0 in Security Advisory 0144, which says the flaw was externally discovered and is actively exploited. VCO is exposed by default and Arista states no configuration prevents exposure; an attack needs only network reachability to the VCO web interface, no credentials. The Fortinet bug is different in kind: FG-IR-25-934, published February 10, 2026, describes a CVSS 5.3 information disclosure in FortiOS SSL-VPN that bypasses the earlier patch for the symlink persistence mechanism using crafted HTTP requests, and it only works for an attacker who already holds filesystem-level read access from a previous compromise. Fixed builds are VCO 5.2.3.14, 6.1.3.4, 6.4.2.4 and 7.0.0.1, and FortiOS 7.6.2 or 7.4.7.

The pairing is the argument. CVE-2026-16812 is a fleet-pivot primitive, not a one-host RCE: the orchestrator stores the credentials, configuration and device inventory for an entire VeloCloud edge deployment, and Arista's own post-remediation guidance warns that a compromised VCO can expose the managed Edge devices as well. For MSPs and distributed enterprises running one on-prem orchestrator over hundreds of branches, a single pre-auth web request class converts into an all-clients breach, which is why this KEV add outranks the day's routine catalog churn. The Fortinet entry documents the other half of the lifecycle: an actor who lost a foothold when the original symlink trick was patched can walk back in, and CISA listing it five months after the February advisory means that walk-back is happening now, on devices that were patched once and written off as clean. The 5.3 score understates it, because the vulnerability has no standalone value and only matters as evidence a breach already happened.

On VCO, upgrade to 5.2.3.14, 6.1.3.4, 6.4.2.4 or 7.0.0.1 per train; Arista offers no workaround beyond restricting the web interface to trusted administrative networks. Block and hunt 8.19.75.217, 206.72.242.124 and 206.72.242.162, the three source IPs Arista published from observed attacks. In VCO web access logs, look for URL-like path components, encoded characters, references to local or internal services, and high request rates, then correlate those timestamps with backend application and system logs, unexplained database exports or archive artifacts, and unexpected outbound HTTP or HTTPS from the VCO host. Preserve those logs before rebuilding, rotate credentials reachable from the orchestrator, and validate the state of managed Edge devices. On FortiOS, upgrade to 7.6.2 or 7.4.7 and migrate the 7.2, 7.0 and 6.4 trains off unsupported builds; Fortinet notes devices that never enabled SSL-VPN are not impacted, and the FMWP virtual patch FG-VD-60389.0day in db update 26.033 covers the bypass until then. Any FortiGate previously flagged for symlink persistence stays suspect until reimaged, because this KEV entry is proof the prior fix gets bypassed.

Two developments would change the assessment. Arista has already widened the advisory once: revision 1.1 on August 3, 2026 added VeloCloud Orchestrator Hosted to the affected platforms, so hosted-orchestration customers cannot assume the provider absorbed the risk, and further scope growth or additional attacker IPs would mark an ongoing campaign rather than a closed incident. If the FortiOS symlink bypass is reported against patched 7.6.2 or 7.4.7 builds, or SSL-VPN endpoint scanning picks up broadly, the read-back capability graduates from a post-breach persistence tool to an independent re-entry vector and every previously breached FortiGate becomes a rebuild candidate.