# CISA Adds Two Known Exploited Vulnerabilities to Catalog: Fortinet FortiOS Information Disclosure (CVE-2025-68686) and Arista VeloCloud Orchestrator OS Command Injection (CVE-2026-16812)

> CISA added two actively-exploited vulnerabilities to its KEV catalog on 2026-07-27: CVE-2025-68686, a FortiOS flaw letting a remote unauthenticated attacker bypass Fortinet's SSL-VPN symlink-persistence patch on already-compromised devices, and CVE-2026-16812, a maximum-severity (CVSS 10.0) OS command injection in Arista VeloCloud Orchestrator On-Prem that exposes internal-only privileged functionality to unauthenticated remote attackers.

- **Published:** 2026-07-27T00:00:00Z
- **Last reviewed:** 2026-07-28T07:19:10.332Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1725
- **ID:** TL-2026-1725
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-68686, CVE-2026-16812, CVE-2022-42475, CVE-2023-27997, CVE-2024-21762

## Description

This threat bundles two independent CISA KEV additions announced the same day. CVE-2025-68686 (CWE-200, CVSS 3.1 base 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) affects Fortinet FortiOS 6.4/7.0/7.2 (all versions) and 7.4.0-7.4.6/7.6.0-7.6.1. It is a bypass of the patch Fortinet shipped (versions 7.6.2, 7.4.7, 7.2.11, 7.0.17, 6.4.16) to remove a symlink-based persistence technique first disclosed in April 2025: threat actors who had achieved remote code execution via CVE-2022-42475, CVE-2023-27997, or CVE-2024-21762 created a symbolic link connecting the user and root filesystems inside the directory used to serve SSL-VPN UI language files, giving them continued read-only access to device configuration even after the initial RCE vulnerability was patched. Fortinet CISO Carl Windsor confirmed the symlink was placed strategically in the user filesystem to evade detection and could survive even after the original RCE vulnerabilities were remediated. Shadowserver identified 16,620 internet-exposed FortiGate devices still carrying the malicious symlink as of 2025-04-15, distributed globally across Asia (7,886), Europe (3,766), and North America (3,217); CERT-FR documented related compromises dating back to early 2023. CVE-2025-68686 lets an unauthenticated attacker send crafted HTTP requests to bypass Fortinet's symlink-removal fix on a device that was previously compromised at the filesystem level — it cannot be exploited standalone, requires SSL-VPN to be enabled, and the vulnerability itself is information-disclosure only (no confirmed integrity/availability impact per NVD's AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N vector). Fortinet credits researcher Peter Gabaldon (ITRESIT) and published PSIRT advisory FG-IR-25-934 (initial: 2026-02-10/13, updated 2026-03-12), alongside FortiGuard FMWP virtual-patch signature FG-VD-60389.0day (DB update 26.033).

CVE-2026-16812 (CWE-78, CVSS 3.1 and 4.0 both 10.0 CRITICAL, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) affects Arista VeloCloud Orchestrator (VCO) On-Prem 5.2.0-<5.2.3.14, 6.1.0-<6.1.3.4, 6.4.0-<6.4.2.4, and 7.0.0-<7.0.0.1. Per Arista Security Advisory 0144 (published 2026-07-27, Bug ID 1901675), "VCO is exposed by default. There is no configuration that can prevent the exposure" and "VCO tenant or operator credentials are not required for this exposure" — an attacker who reaches the VCO web interface can access administrative/maintenance functionality that "was intended to be for internal use only and is not intended to be remotely accessible," injecting OS commands and gaining privileged access to the underlying orchestrator host. This fully compromises confidentiality, integrity, and availability of the SD-WAN orchestration platform and can expose "VCO database contents, configuration data, device inventory, credentials, certificates, or key material." Arista's own remediation guidance directs operators to hunt for "unexpected outbound HTTP or HTTPS activity originating from the VCO host," "sensitive configuration changes that do not correspond to administrator activity," and "unexpected command execution, file creation, database export, or archive artifacts" — all consistent with post-compromise C2 beaconing, configuration exfiltration, and credential/key-material theft. Arista identified three IP addresses observed conducting attacks against the flaw: 8.19.75.217, 206.72.242.124, and 206.72.242.162; a BeaconBeagle infrastructure-correlation check against all three returned no existing beacon/C2 record (no historical match at query time). Only VCO On-Prem was affected — Hosted, Dedicated, Gateway, and Edge VeloCloud products, plus all EOS-based switches and CloudVision, were unaffected or already patched by Arista before the advisory's public release. Arista states the issue was discovered externally and is known to be actively exploited. Fixed releases are 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1.

CISA added both CVEs to the KEV catalog on 2026-07-27 under Binding Operational Directive 26-04, with remediation due dates of 2026-07-30 (CVE-2026-16812) and 2026-08-10 (CVE-2025-68686) for FCEB agencies. Because a VeloCloud Orchestrator manages the configuration of an organization's entire SD-WAN edge fleet — making orchestrator compromise a potential vector for pushing malicious configuration to every managed Edge device — and a compromised FortiGate can be turned into durable, patch-resistant attacker infrastructure, both vulnerabilities represent high-value targets for perimeter and orchestration-layer compromise.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1601 Modify System Image
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1014 Rootkit
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1005 Data from Local System
- T1602 Data from Configuration Repository
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1210 Exploitation of Remote Services
- T1072 Software Deployment Tools
- T1565 Data Manipulation
- T1489 Service Stop
- T1133 External Remote Services
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1213 Data from Information Repositories

## Sources

- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA Known Exploited Vulnerabilities Catalog (data feed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [NVD - CVE-2025-68686 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-68686)
- [NVD - CVE-2026-16812 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-16812)
- [FortiGuard PSIRT Advisory FG-IR-25-934: SSL-VPN Symlink Persistence Patch Bypass](https://fortiguard.fortinet.com/psirt/FG-IR-25-934)
- [Arista Security Advisory 0144](https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144)
- [CVE-2025-68686: Fortinet FortiOS Information Disclosure](https://www.sentinelone.com/vulnerability-database/cve-2025-68686/)
- [Fortinet Warns Attackers Retain FortiGate Access Post-Patching via SSL-VPN Symlink Exploit](https://thehackernews.com/2025/04/fortinet-warns-attackers-retain.html)
- [Hackers exploit old FortiGate vulnerabilities, use symlink trick to retain limited access to patched devices](https://www.helpnetsecurity.com/2025/04/11/fortios-fortigate-vulnerabilities-symlink-trick-limited-access/)
- [CISA KEV Catalog entry — CVE-2025-68686](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686)
- [CISA KEV Catalog entry — CVE-2026-16812](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1725