Threat reportVulnerabilityTL-2026-1725
CISA Adds Two Known Exploited Vulnerabilities to Catalog: Fortinet FortiOS Information Disclosure (CVE-2025-68686) and Arista VeloCloud Orchestrator OS Command Injection (CVE-2026-16812)
CISA Adds Two Known Exploited Vulnerabilities to Catalog (TL-2026-1725) is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-27 and last reviewed 2026-07-28. It has no confirmed attribution, affects Fortinet FortiOS, references 5 CVEs (CVE-2025-68686, CVE-2026-16812, CVE-2022-42475), maps to 22 MITRE ATT&CK techniques (T1005, T1014, T1018), and is covered by 9 detection rules and 33 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 22MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 33Indicators of compromise
Key facts for TL-2026-1725
- Threat ID
- TL-2026-1725
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, enterprise-networking
- Detection rules
- 9
- Indicators of compromise
- 33
- Updates
- 2026-07-28 · revalidated 1× · latest source
Malware and tooling in CISA Adds Two Known Exploited Vulnerabilities to Catalog
Malware and tooling: FortiGuard FMWP signature FG-VD-60389.0day (DB update 26.033)
How CISA Adds Two Known Exploited Vulnerabilities to Catalog works
CISA added two actively-exploited vulnerabilities to its KEV catalog on 2026-07-27: CVE-2025-68686, a FortiOS flaw letting a remote unauthenticated attacker bypass Fortinet's SSL-VPN symlink-persistence patch on already-compromised devices, and CVE-2026-16812, a maximum-severity (CVSS 10.0) OS command injection in Arista VeloCloud Orchestrator On-Prem that exposes internal-only privileged functionality to unauthenticated remote attackers.
This threat bundles two independent CISA KEV additions announced the same day. CVE-2025-68686 (CWE-200, CVSS 3.1 base 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) affects Fortinet FortiOS 6.4/7.0/7.2 (all versions) and 7.4.0-7.4.6/7.6.0-7.6.1. It is a bypass of the patch Fortinet shipped (versions 7.6.2, 7.4.7, 7.2.11, 7.0.17, 6.4.16) to remove a symlink-based persistence technique first disclosed in April 2025: threat actors who had achieved remote code execution via CVE-2022-42475, CVE-2023-27997, or CVE-2024-21762 created a symbolic link connecting the user and root filesystems inside the directory used to serve SSL-VPN UI language files, giving them continued read-only access to device configuration even after the initial RCE vulnerability was patched. Fortinet CISO Carl Windsor confirmed the symlink was placed strategically in the user filesystem to evade detection and could survive even after the original RCE vulnerabilities were remediated. Shadowserver identified 16,620 internet-exposed FortiGate devices still carrying the malicious symlink as of 2025-04-15, distributed globally across Asia (7,886), Europe (3,766), and North America (3,217); CERT-FR documented related compromises dating back to early 2023. CVE-2025-68686 lets an unauthenticated attacker send crafted HTTP requests to bypass Fortinet's symlink-removal fix on a device that was previously compromised at the filesystem level — it cannot be exploited standalone, requires SSL-VPN to be enabled, and the vulnerability itself is information-disclosure only (no confirmed integrity/availability impact per NVD's AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N vector). Fortinet credits researcher Peter Gabaldon (ITRESIT) and published PSIRT advisory FG-IR-25-934 (initial: 2026-02-10/13, updated 2026-03-12), alongside FortiGuard FMWP virtual-patch signature FG-VD-60389.0day (DB update 26.033).
CVE-2026-16812 (CWE-78, CVSS 3.1 and 4.0 both 10.0 CRITICAL, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) affects Arista VeloCloud Orchestrator (VCO) On-Prem 5.2.0-<5.2.3.14, 6.1.0-<6.1.3.4, 6.4.0-<6.4.2.4, and 7.0.0-<7.0.0.1. Per Arista Security Advisory 0144 (published 2026-07-27, Bug ID 1901675), "VCO is exposed by default. There is no configuration that can prevent the exposure" and "VCO tenant or operator credentials are not required for this exposure" — an attacker who reaches the VCO web interface can access administrative/maintenance functionality that "was intended to be for internal use only and is not intended to be remotely accessible," injecting OS commands and gaining privileged access to the underlying orchestrator host. This fully compromises confidentiality, integrity, and availability of the SD-WAN orchestration platform and can expose "VCO database contents, configuration data, device inventory, credentials, certificates, or key material." Arista's own remediation guidance directs operators to hunt for "unexpected outbound HTTP or HTTPS activity originating from the VCO host," "sensitive configuration changes that do not correspond to administrator activity," and "unexpected command execution, file creation, database export, or archive artifacts" — all consistent with post-compromise C2 beaconing, configuration exfiltration, and credential/key-material theft. Arista identified three IP addresses observed conducting attacks against the flaw: 8.19.75.217, 206.72.242.124, and 206.72.242.162; a BeaconBeagle infrastructure-correlation check against all three returned no existing beacon/C2 record (no historical match at query time). Only VCO On-Prem was affected — Hosted, Dedicated, Gateway, and Edge VeloCloud products, plus all EOS-based switches and CloudVision, were unaffected or already patched by Arista before the advisory's public release. Arista states the issue was discovered externally and is known to be actively exploited. Fixed releases are 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1.
CISA added both CVEs to the KEV catalog on 2026-07-27 under Binding Operational Directive 26-04, with remediation due dates of 2026-07-30 (CVE-2026-16812) and 2026-08-10 (CVE-2025-68686) for FCEB agencies. Because a VeloCloud Orchestrator manages the configuration of an organization's entire SD-WAN edge fleet — making orchestrator compromise a potential vector for pushing malicious configuration to every managed Edge device — and a compromised FortiGate can be turned into durable, patch-resistant attacker infrastructure, both vulnerabilities represent high-value targets for perimeter and orchestration-layer compromise.
MITRE ATT&CK techniques used in TL-2026-1725
Collection
T1005 Data from Local System; T1213 Data from Information Repositories; T1560 Archive Collected Data; T1602 Data from Configuration Repository
Defense Evasion
T1014 Rootkit; T1211 Exploitation for Stealth
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1082 System Information Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol
Lateral Movement
T1072 Software Deployment Tools; T1210 Exploitation of Remote Services
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Impact
T1489 Service Stop; T1565 Data Manipulation
Credential Access
Reconnaissance
defense-impairment
Affected products and versions in CISA Adds Two Known Exploited Vulnerabilities to Catalog
- Fortinet — FortiOS
Vulnerable versions: 6.4 (all versions); 7.0 (all versions); 7.2 (all versions); 7.4.0-7.4.6; 7.6.0-7.6.1
Fixed in: 6.4.16; 7.0.17; 7.2.11; 7.4.7; 7.6.2 - Arista Networks — VeloCloud Orchestrator On-Prem
Vulnerable versions: 5.2.0-<5.2.3.14; 6.1.0-<6.1.3.4; 6.4.0-<6.4.2.4; 7.0.0-<7.0.0.1
Fixed in: 5.2.3.14; 6.1.3.4; 6.4.2.4; 7.0.0.1
Remediation for CISA Adds Two Known Exploited Vulnerabilities to Catalog
Patches
- FG-IR-25-934: FortiOS 7.6.2, 7.4.7, 7.2.11, 7.0.17, 6.4.16
- Arista Security Advisory 0144: VeloCloud Orchestrator On-Prem 5.2.3.14, 6.1.3.4, 6.4.2.4, 7.0.0.1
Immediate actions
- Upgrade FortiOS to 7.6.2+, 7.4.7+, 7.2.11+, 7.0.17+, or 6.4.16+ per FG-IR-25-934 to close the CVE-2025-68686 symlink-persistence patch bypass
- Upgrade VeloCloud Orchestrator On-Prem to 5.2.3.14+, 6.1.3.4+, 6.4.2.4+, or 7.0.0.1+ per Arista Security Advisory 0144 to close CVE-2026-16812
- Restrict the VCO administrative/web interface to trusted management networks until patched
- Treat any FortiGate device that has had SSL-VPN enabled as potentially already compromised: forensically inspect the SSL-VPN language-file directory for symlinks, reset admin credentials, and revoke/reissue certificates
- Block/alert on inbound traffic from the three attacker IPs Arista disclosed for CVE-2026-16812: 8.19.75.217, 206.72.242.124, 206.72.242.162
- Hunt VCO web access logs for requests with unusual URL-like path components, encoded characters, references to local/internal services, or abnormally high request rates
Workarounds
- FortiOS: disable SSL-VPN if not required for operations
- VeloCloud Orchestrator: restrict administrative/web interface access to trusted networks until the patch is applied
Longer-term hardening
- Disable SSL-VPN on FortiOS where not operationally required
- Enforce network segmentation and ACLs restricting management-plane access to both FortiOS and VeloCloud Orchestrator
- Enable and keep current FortiGuard IPS/AV signatures (FMWP DB 26.033 / FG-VD-60389.0day) to detect exploitation attempts against CVE-2025-68686
- Build a standing CISA-KEV / BOD-26-04 remediation workflow for perimeter and SD-WAN orchestration devices given their recurring KEV appearance
- Monitor VCO hosts for unexpected outbound HTTP/HTTPS activity, unauthorized configuration changes, and unexpected database export/archive artifact creation
CVEs associated with CISA Adds Two Known Exploited Vulnerabilities to Catalog
CVE-2025-68686, CVE-2026-16812, CVE-2022-42475, CVE-2023-27997, CVE-2024-21762
Weaknesses (CWE) in CISA Adds Two Known Exploited Vulnerabilities to Catalog
Timeline of CISA Adds Two Known Exploited Vulnerabilities to Catalog
- CERT-FR documents the earliest observed FortiGate symlink-persistence compromises dating to early 2023, following initial-access exploitation of then-current FortiOS SSL-VPN RCE vulnerabilities.
- Fortinet and independent researchers publicly detail a stealthy symlink-based persistence technique used against previously-compromised FortiGate devices, connecting the user and root filesystems inside the SSL-VPN language-file directory; Shadowserver reports 16,620 internet-exposed devices still carrying the malicious symlink.
- CVE-2025-68686 (FortiOS SSL-VPN symlink-persistence patch bypass, CWE-200) published to NVD; Fortinet PSIRT advisory FG-IR-25-934 issued the same day.
- FG-IR-25-934 formally published by Fortinet, detailing the patch bypass and the fixed FortiOS releases (7.6.2, 7.4.7, 7.2.11, 7.0.17, 6.4.16); credited to researcher Peter Gabaldon of ITRESIT.
- Fortinet updates the FG-IR-25-934 advisory.
- Arista Security Advisory 0144 additionally confirms Arista wireless access points are NOT affected by CVE-2026-16812, beyond the Hosted/Dedicated/EOS/CloudVision exclusions already on record.
- CISA adds both CVE-2025-68686 and CVE-2026-16812 to the Known Exploited Vulnerabilities catalog based on confirmed evidence of active exploitation, publishing the alert "CISA Adds Two Known Exploited Vulnerabilities to Catalog."
- Arista publishes Security Advisory 0144 (Bug ID 1901675) for CVE-2026-16812, an OS command injection (CWE-78, CVSS 10.0) in VeloCloud Orchestrator On-Prem, reachable via internal-only functionality exposed to unauthenticated remote attackers with no configuration able to prevent the exposure; Arista discloses three attacker IPs (8.19.75.217, 206.72.242.124, 206.72.242.162) observed exploiting it. Hosted and Dedicated VCO tenants were already patched before this disclosure.
- As of 2026-07-28, no public proof-of-concept exploit code for CVE-2026-16812 has been disclosed per BleepingComputer/SecurityWeek reporting; observed exploitation was identified via source-IP telemetry rather than published exploit code, and no named threat actor or campaign has been attributed.
- CISA BOD-26-04 remediation due date for CVE-2026-16812 (Arista VeloCloud Orchestrator On-Prem OS command injection) for FCEB agencies.
- CISA BOD-26-04 remediation due date for CVE-2025-68686 (FortiOS symlink-persistence patch bypass) for FCEB agencies.
Update history for TL-2026-1725
- 2026-07-28 — CVE-2026-16812: Critical Arista VeloCloud Orchestrator Command Injection Exploited as Zero-Day: What changed No field escalation — severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), cvss_score (10.0), and attribution (LOW confidence, unattributed) were already at the same level in the existing record; the newer report does
Sources cited for CISA Adds Two Known Exploited Vulnerabilities to Catalog
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
- CISA Known Exploited Vulnerabilities Catalog (data feed)
- NVD - CVE-2025-68686 Detail
- NVD - CVE-2026-16812 Detail
- FortiGuard PSIRT Advisory FG-IR-25-934: SSL-VPN Symlink Persistence Patch Bypass
- Arista Security Advisory 0144
- CVE-2025-68686: Fortinet FortiOS Information Disclosure
- Fortinet Warns Attackers Retain FortiGate Access Post-Patching via SSL-VPN Symlink Exploit
- Hackers exploit old FortiGate vulnerabilities, use symlink trick to retain limited access to patched devices
- CISA KEV Catalog entry — CVE-2025-68686
- CISA KEV Catalog entry — CVE-2026-16812
Detection coverage for TL-2026-1725
As of 2026-07-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1725 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.