The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding two vulnerabilities affecting Fortinet FortiOS and Arista VeloCloud Orchestrator. While the two flaws differ significantly in severity and attack complexity, they share one important characteristic—they are actively exploited in the wild.
The latest additions serve as another reminder that organizations should prioritize remediation based on active exploitation, not solely on CVSS scores.
CVE-2025-68686 – Fortinet FortiOS
Vulnerability Overview
CVE-2025-68686 affects Fortinet FortiOS and involves the exposure of sensitive information through specially crafted HTTP requests.
Unlike many remote code execution vulnerabilities, this issue does not provide attackers with initial access. Instead, it becomes valuable after an attacker has already compromised the device through another vulnerability or attack vector.
The flaw allows attackers with filesystem-level access to bypass protections designed to prevent malicious symbolic-link persistence, potentially exposing sensitive information stored on the appliance.
Why It Matters
At first glance, the moderate CVSS score may appear less concerning. However, active exploitation demonstrates that attackers are chaining this vulnerability with other weaknesses to strengthen persistence and extract sensitive information.
This highlights an important lesson for defenders:
A vulnerability with a moderate severity score can still become highly dangerous when used as part of a multi-stage attack.
Organizations operating FortiGate firewalls should ensure they are running supported software versions and install Fortinet’s security updates immediately.
CVE-2026-16812 – Arista VeloCloud Orchestrator
Vulnerability Overview
CVE-2026-16812 affects Arista VeloCloud Orchestrator On-Prem and is significantly more severe.
The vulnerability is an OS Command Injection flaw that enables an unauthenticated attacker to execute arbitrary operating system commands remotely.
With a CVSS score of 10.0, successful exploitation can result in complete compromise of the orchestrator, allowing attackers to take control of the underlying system.
Why It Matters
VeloCloud Orchestrator acts as the central management platform for SD-WAN deployments.
A successful compromise could potentially allow attackers to:
- Gain administrative control of the orchestration platform.
- Manipulate SD-WAN configurations.
- Disrupt enterprise network connectivity.
- Establish long-term persistence.
- Use the orchestrator as a pivot point for further attacks.
Because these systems often manage distributed branch networks, their compromise can have organization-wide consequences.
Recommended Actions for Security Teams
Organizations should immediately:
- Identify all Fortinet FortiOS and Arista VeloCloud deployments.
- Determine whether vulnerable software versions are in use.
- Apply vendor-provided patches without delay.
- Review administrative and VPN logs for suspicious activity.
- Inspect systems for indicators of compromise before and after patching.
- Validate that internet-facing management interfaces are appropriately secured.
- Update vulnerability management processes so KEV-listed vulnerabilities receive accelerated remediation.
Final Thoughts
The addition of CVE-2025-68686 and CVE-2026-16812 to the CISA KEV Catalog underscores a simple but critical reality: active exploitation should drive patch prioritization.
Whether the vulnerability enables information disclosure after compromise or unauthenticated remote command execution, its presence in the KEV Catalog signals that adversaries are already leveraging it. Security teams should treat these vulnerabilities as immediate priorities, validate exposure across their environments, and remediate affected systems before attackers can capitalize on them.
Very nice.