Listen to this Post
Introduction, A New Warning for Organizations Facing Persistent Cyber Threats
Cybersecurity defenders continue to face an increasingly aggressive threat landscape where attackers move faster than organizations can deploy security updates. The latest action from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) highlights just how serious this challenge has become. By adding newly exploited vulnerabilities affecting Fortinet FortiOS and Arista’s VMware VeloCloud Orchestrator to its Known Exploited Vulnerabilities (KEV) Catalog, CISA is signaling that these are no longer theoretical risks. They are active attack vectors already being used against real organizations.
The inclusion of these flaws in the KEV Catalog serves as a direct warning to government agencies and private enterprises alike. Organizations relying on Fortinet security appliances or VMware VeloCloud SD-WAN infrastructure should treat these vulnerabilities as high-priority security incidents. Immediate patching, comprehensive log analysis, and forensic preservation are now critical steps for preventing further compromise.
CISA Expands the Known Exploited Vulnerabilities Catalog
The U.S. Cybersecurity and Infrastructure Security Agency has officially added two significant vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in real-world attacks.
The newly listed vulnerabilities include:
CVE-2025-68686, affecting multiple versions of Fortinet FortiOS
CVE-2026-16812, impacting on-premises VMware VeloCloud Orchestrator (VCO) deployments, now managed by Arista
Their addition to the KEV Catalog reflects confirmed evidence that threat actors are actively abusing these flaws, making rapid remediation essential.
Understanding CVE-2025-68686, A Fortinet Patch Bypass Vulnerability
Unlike many security flaws, CVE-2025-68686 cannot be exploited independently.
Instead, attackers must first compromise a FortiOS appliance using another vulnerability that grants filesystem-level access.
Once this initial compromise has been achieved, attackers can send specially crafted HTTP requests to bypass Fortinet’s previous mitigation designed to prevent malicious symbolic links from persisting after exploitation.
This effectively weakens an earlier security fix.
Rather than creating an entirely new attack path, the vulnerability allows attackers who already control part of the system to regain access to files or sensitive resources that administrators believed were already protected.
The result is an increased opportunity for post-exploitation persistence, information disclosure, and long-term compromise.
Why the Fortinet Vulnerability Is Particularly Dangerous
Although the flaw requires an existing compromise, it dramatically strengthens an attacker’s position once inside a network.
After breaching a FortiOS appliance, threat actors can continue accessing protected data while bypassing remediation efforts designed to eliminate malicious symbolic links.
This creates several security concerns:
Extended Persistence
Attackers can maintain access even after administrators attempt cleanup.
Sensitive Information Exposure
Protected files may once again become accessible despite previous mitigation efforts.
Reduced Effectiveness of Security Fixes
Organizations believing they fully remediated earlier attacks may unknowingly remain compromised.
Inside CVE-2026-16812, VMware VeloCloud Orchestrator at Risk
The second vulnerability is significantly different.
CVE-2026-16812 affects on-premises VMware VeloCloud Orchestrator deployments used to manage SD-WAN infrastructure.
The flaw exposes privileged internal functionality intended exclusively for trusted internal services.
Due to insufficient access restrictions, remote attackers can invoke these privileged functions directly.
Successful exploitation may allow unauthorized access to the underlying orchestrator host itself.
Once inside, attackers may gain the ability to:
View sensitive network information
Modify SD-WAN configurations
Disrupt orchestrator operations
Impact confidentiality, integrity, and availability
Potentially compromise connected enterprise environments
VMware confirmed that the vulnerability is already being actively exploited.
Hosted Customers Receive Protection Before Public Disclosure
One important distinction involves deployment models.
Organizations using Hosted or Dedicated VMware VeloCloud Orchestrator services received patches before the vulnerability became public.
However, businesses operating their own on-premises orchestrators remain responsible for installing available security updates.
Failure to patch could leave enterprise SD-WAN management infrastructure exposed to active exploitation.
Arista Confirms Active Exploitation
Arista acknowledged that the vulnerability was discovered externally and confirmed that attackers are actively exploiting affected systems.
While the company did not disclose how many organizations may have been compromised, it published three IP addresses associated with observed attacks:
8.19.75.217
206.72.242.124
206.72.242.162
Security teams are encouraged to:
Block these indicators of compromise where appropriate.
Review firewall and proxy logs.
Examine authentication activity.
Search historical logs for suspicious requests.
Preserve forensic evidence before performing remediation.
According to Arista, organizations should retain:
Web access logs
Backend application logs
Operating system logs
Database logs
Filesystem timestamps
These artifacts can become invaluable during incident response investigations.
CISA Issues Mandatory Deadlines for Federal Agencies
Under Binding Operational Directive (BOD) 22-01, federal civilian executive branch agencies must remediate vulnerabilities listed in the KEV Catalog within CISA’s specified deadlines.
The required remediation dates are:
Arista VMware VeloCloud Orchestrator (CVE-2026-16812): July 20, 2026
Fortinet FortiOS (CVE-2025-68686): August 10, 2026
Although these deadlines specifically apply to U.S. federal agencies, cybersecurity experts strongly recommend that private organizations follow the same urgency.
Attackers rarely distinguish between government and commercial targets once an exploit becomes publicly available.
How Organizations Should Respond Immediately
Security teams should prioritize several defensive measures.
Apply Vendor Security Updates
Install all available patches as soon as operationally possible.
Investigate Existing Systems
Look for signs of historical compromise instead of assuming systems remain clean.
Preserve Evidence
Avoid wiping affected devices before collecting forensic logs.
Monitor Network Activity
Review authentication events, administrative actions, and unexpected HTTP requests.
Review Existing Security Controls
Confirm previous remediation efforts remain effective following software updates.
Deep Analysis
Modern attacks rarely rely on a single vulnerability. Instead, attackers chain multiple weaknesses together to achieve persistence, privilege escalation, and long-term access. The Fortinet vulnerability is a textbook example of post-exploitation enhancement, where an attacker who has already breached a device can undermine an earlier security mitigation. The Arista VMware VeloCloud Orchestrator issue demonstrates another common trend, exposure of privileged internal functions that were never meant to be accessible externally. Together, these flaws show why patching alone is not enough. Organizations must validate that no compromise occurred before the update was installed.
Useful Incident Response Commands
Check listening services
ss -tulpn netstat -tulpn
Review recent authentication events
last lastlog journalctl -u ssh
Search web server logs for suspicious requests
grep -i "GET" access.log grep -Ei "symbolic|symlink|../" access.log
Identify modified files
find / -mtime -7 find /var/www -type f -mtime -7
Monitor unexpected processes
ps aux top htop
Review network connections
lsof -i ss -antp Block malicious IP addresses (Linux iptables example)
iptables -A INPUT -s 8.19.75.217 -j DROP iptables -A INPUT -s 206.72.242.124 -j DROP iptables -A INPUT -s 206.72.242.162 -j DROP
Review Indicators of Compromise
grep -R "206.72.242" /var/log grep -R "8.19.75.217" /var/log
These commands are intended to support investigation and defensive monitoring. They should be adapted to each organization’s operating environment and incident response procedures.
What Undercode Say
The latest KEV additions reinforce an important reality in cybersecurity, attackers are increasingly exploiting weaknesses that extend the impact of previous compromises rather than relying solely on new vulnerabilities. CVE-2025-68686 demonstrates how post-exploitation techniques continue to evolve, allowing adversaries to bypass mitigations that defenders may have trusted. This highlights the need for security teams to validate remediation instead of assuming a patch has fully eliminated risk.
The Arista VMware VeloCloud Orchestrator vulnerability is equally concerning because SD-WAN platforms often sit at the center of enterprise connectivity. A compromise at this layer can provide visibility into branch offices, cloud environments, and critical network traffic. If attackers gain privileged access to orchestration systems, they may manipulate routing policies, intercept communications, or disrupt business operations on a large scale.
Another lesson is the growing importance of forensic readiness. Arista’s recommendation to preserve web logs, database records, application logs, and filesystem timestamps before remediation reflects modern incident response best practices. Organizations that immediately rebuild compromised systems without collecting evidence may lose the ability to determine the initial intrusion vector, the attack timeline, or whether additional persistence mechanisms remain active.
Security leaders should also recognize that many recent attacks involve chained vulnerabilities. Threat actors often combine an initial access flaw with privilege escalation, persistence mechanisms, and information disclosure weaknesses to maximize their control. Defenders should therefore evaluate vulnerabilities not only by their standalone severity scores but also by how they can interact with other weaknesses already present in the environment.
Continuous asset inventory remains a critical defensive measure. Enterprises frequently overlook legacy appliances, remote branch systems, or development environments that continue running outdated firmware. Automated discovery tools, vulnerability scanners, and configuration management platforms should be used to identify systems requiring urgent updates.
Threat intelligence integration is another key factor. Organizations should continuously monitor vendor advisories, CISA KEV updates, and industry intelligence feeds to ensure emerging exploitation trends are incorporated into defensive operations. Delayed awareness often translates directly into increased exposure.
Network segmentation can significantly reduce the impact of a compromised orchestrator or firewall appliance. Isolating management interfaces, enforcing least-privilege access, and implementing strict authentication controls can help contain attackers even if they successfully exploit a vulnerability.
Logging and telemetry should be centralized in a Security Information and Event Management (SIEM) platform, enabling correlation of suspicious HTTP requests, privilege changes, configuration modifications, and outbound network connections. Behavioral analytics can further enhance detection by identifying unusual administrative actions.
Regular penetration testing and purple team exercises can validate whether defensive controls effectively detect post-exploitation activities similar to those described in these vulnerabilities. Such exercises provide valuable insight into gaps that automated vulnerability scanning alone may not reveal.
Ultimately, these KEV additions are another reminder that cybersecurity is no longer just about patch management. Effective defense requires continuous monitoring, proactive threat hunting, robust incident response planning, and a mature security culture that anticipates attacker behavior rather than simply reacting to it.
Prediction
(+1) ✅ The continued expansion of
(+1) Security vendors are likely to strengthen post-exploitation protections, improve forensic logging capabilities, and introduce additional safeguards against persistence techniques targeting enterprise appliances.
(-1) ⚠️ Threat actors will continue chaining vulnerabilities across firewalls, SD-WAN platforms, identity systems, and cloud infrastructure, making multi-stage attacks more common and increasing the importance of proactive threat hunting.
✅ Confirmed: CISA has added CVE-2025-68686 affecting Fortinet FortiOS and CVE-2026-16812 affecting on-premises VMware VeloCloud Orchestrator to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation.
✅ Confirmed: The Fortinet vulnerability does not provide initial access by itself. It requires a prior filesystem-level compromise before an attacker can bypass symbolic link protections and expose protected information.
✅ Confirmed: Federal agencies are required under Binding Operational Directive (BOD) 22-01 to remediate these vulnerabilities by CISA’s specified deadlines, while private organizations are strongly encouraged to patch immediately to reduce their exposure to ongoing attacks.
▶️ Related Video (80% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.twitter.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
