On July 27, CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including a maximum-severity remote command injection flaw in Arista’s VeloCloud Orchestrator On-Prem that lets unauthenticated attackers hijack enterprise networking infrastructure. The second entry, a FortiOS SSL-VPN information exposure, allows attackers who already have a foothold to bypass patched defenses and maintain access. For Windows admins, the message is blunt: these aren’t isolated appliance issues—they can open direct paths to Active Directory, credentials, and sensitive workloads.

Two Critical Vulnerabilities Join the KEV List

CISA’s July 27 update puts two very different threats under the same urgent-remit umbrella. Understanding the distinction is the first step toward a sane response.

CVE-2026-16812 – Arista VeloCloud Orchestrator On-Prem OS Command Injection
This is the showstopper. Arista’s own advisory gives it a CVSS v3.1 and v4.0 score of 10.0, the highest possible. The vulnerability (CWE-78) exists in internal functionality that was never meant to be remotely accessible—yet the web interface exposes it by default. An attacker with network access to that interface needs no credentials, no user interaction, and faces low attack complexity to run arbitrary OS commands on the orchestrator host. Successful exploitation can compromise the confidentiality, integrity, and availability of the VCO itself and any data it manages, including connected VeloCloud Edge devices.

Affected versions are:
- VCO 5.2.x before 5.2.3.14
- VCO 6.1.x before 6.1.3.4
- VCO 6.4.x before 6.4.2.4
- VCO 7.0.x before 7.0.0.1

Arista explicitly warns that unsupported VCO versions haven’t been assessed, so older deployments should assume risk until proven otherwise. The vendor’s advisory makes clear that merely restricting the interface to trusted administrative networks reduces exposure but does not replace patching.

CVE-2025-68686 – Fortinet FortiOS Exposure of Sensitive Information
This FortiOS SSL-VPN flaw (CWE-200) carries a Fortinet-assigned CVSS v3.1 score of 5.9. The nuance matters: NIST’s NVD says an attacker must already have compromised the device at the file-system level through another vulnerability. In isolation, it’s a post-exploitation tool that can bypass a symbolic-link persistence patch and leak sensitive data. Fortinet’s advisory stresses that systems that never had SSL-VPN enabled are not affected. Affected releases are:
- FortiOS 7.6.0 through 7.6.1
- FortiOS 7.4.0 through 7.4.6
- All FortiOS 7.2, 7.0, and 6.4 versions

Fixed versions are 7.6.2 or later and 7.4.7 or later; users on the 7.2, 7.0, and 6.4 trains must migrate to a fixed release.

Why Windows Admins Can’t Ignore These Network Appliance Issues

The shortcuts that make network-edge appliances easy to manage—reachable web interfaces, deep integration with identity stores, wide routing privileges—make them devastating when compromised. A penetrated VeloCloud Orchestrator can hand an attacker control over SD-WAN policies, branch connectivity, and the configuration of every managed Edge device. A compromised FortiGate SSL-VPN gateway can expose live access to remote-user sessions, Active Directory authentication, and administrative paths into Windows servers.

For Windows-centric teams, the downstream risk is immediate. Attackers who reach these platforms can:
- Harvest credentials from authentication requests, RADIUS, or LDAP queries
- Pivot through VPN tunnels or site-to-site links into internal subnets
- Modify conditional access policies or MFA configurations if integrated with Azure AD
- Steal certificates, private keys, and configuration backups used to impersonate services
- Disable logging or spawn backdoors that persist long after the original patch

The CISA KEV designation isn’t a theoretical warning—it’s confirmation that these flaws are under active exploitation. For any organization that runs the affected appliances, especially with internet-facing administration, this is an incident-response priority, not just another update ticket.

A Timeline of CISA’s Shift to Risk-Based Patching

CISA’s KEV catalog has evolved from a supplementary list into the backbone of federal vulnerability management. The latest directive, Binding Operational Directive (BOD) 26-04, issued on June 10, 2026, reshapes how agencies prioritize patches. Instead of fixating on CVSS scores alone, teams must weigh public exposure, KEV status, exploit automatability, and technical impact. FedRAMP’s implementation notes that agencies can no longer lean on monthly scan reports; they must actively determine internet reachability and assume an exploit is automatable unless evidence proves otherwise.

The two new additions fit squarely into that model. CVE-2026-16812 is the poster child for why exposure matters: a default-exposed web interface that requires no authentication and yields total control. CVE-2025-68686, while less severe on paper, demonstrates why KEV status overrides a “medium” rating—active exploitation and the ability to undermine prior patches turn a low-severity bug into a persistence enabler.

For private-sector organizations, CISA encourages adopting the same risk-based lens. The days of treating every high-severity CVE as equally urgent are ending. The question to ask isn’t “What’s the CVSS?” but “Is someone already using it on devices like ours?”

Your Immediate Action Plan: Patching, Containment, and Compromise Checks

For Arista VeloCloud Orchestrator On-Prem

  1. Identify exposure now. Map every VCO instance—version, host location, and whether its web interface is reachable from the internet. If so, immediately restrict access to trusted administrative networks (jump hosts, VPN-only ranges, dedicated management subnets). This is not a permanent fix, but it closes the most common attack path.
  2. Patch to a fixed release. Upgrade to 5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1 (or a later supported version in the same train). For unsupported releases, engage Arista support; do not assume safety by silence.
  3. Preserve logs before remediation. Arista’s advisory recommends capturing web-access logs, backend application logs, OS logs, and file-system timestamps. Overwriting evidence with a hasty upgrade can destroy the forensic trail.
  4. Investigate for compromise. Look for the indicators Arista outlines: unusual URL-encoded characters in web logs, unexpected outbound HTTP/HTTPS, unexplained privileged actions (command execution, database exports), or access to configuration data, credentials, or key material. If any indicator surfaces, follow Arista’s post-compromise playbook: rotate all credentials, validate managed-device configurations, and, if necessary, restore from trusted backups.

For Fortinet FortiOS SSL-VPN

  1. Inventory and scope. Catalog every FortiGate appliance—including standby units, branch devices, and lab systems. For each, confirm the FortiOS version and whether SSL-VPN has ever been enabled, not just whether it’s on now.
  2. Patch or migrate. Systems on 7.6.x should move to 7.6.2 or later; 7.4.x to 7.4.7 or later. For the 7.2, 7.0, and 6.4 branches, Fortinet advises migration to a fixed release. If SSL-VPN has never been enabled, the device is not impacted by this CVE—but verify that configuration history hasn’t left residual exposure.
  3. Harden remote access. Beyond this patch, minimize internet-facing administration interfaces, limit VPN exposure to required services, and enforce strong MFA. Retain configuration backups and VPN logs in case retrospective investigation is needed.
  4. Review for prior exploitation. Because this flaw requires an existing compromise, focus on appliances that may have been hit by older FortiOS vulnerabilities. Check for unexpected admin account creation, policy changes, or suspicious connections to unfamiliar command-and-control infrastructure.

Cross-Team Compromise Checks for Windows Environments

A Windows security operations team should coordinate with networking counterparts on these steps:

  • Identity systems: Audit privileged sign-ins, new accounts, MFA policy changes, and federation or directory sync anomalies in Active Directory and Entra ID.
  • Remote access logs: Review RADIUS, VPN, and identity-provider logs for abnormal authentication patterns that align with the vulnerability timeline.
  • Administrative workstations: Inspect Windows endpoint logs from any machine used to manage the affected appliances. Session tokens, cached credentials, and browser artifacts may reveal lateral movement.
  • Network configuration: Validate routes, firewall rules, SD-WAN policies, and DNS settings against known-good baselines.
  • Secrets hygiene: If the compromised platform stored administrative credentials, API keys, or certificates, initiate targeted rotation and re-enrollment.
  • Lateral movement signals: Hunt for unusual WinRM, RDP, SMB, or PowerShell remoting activity, particularly from subnets associated with the breached device.

Document all findings. Even if you find no immediate evidence, keep logs for the period preceding patching—it may later prove invaluable.

Securing the Edge Beyond This Alert

CISA’s KEV update is a harsh reminder that management consoles and VPN gateways remain the soft underbelly of enterprise security. The VCO flaw in particular—remote, unauthenticated, default-exposed—underscores a systemic failure to design administration interfaces with the zero-trust assumption that every network is hostile.

Organizations should expect more such additions. As BOD 26-04 matures, the bar for what counts as “urgent” will increasingly tilt toward exposure and exploitation reality. The most effective long-term response isn’t faster patching alone; it’s shrinking the attack surface by removing direct internet access from any administrative interface that doesn’t absolutely require it, segmenting management networks, and integrating appliance logs into Windows-centric security operations tools. Because when an attacker breaches a networking appliance, the domain controller is often the next stop.