CISA KEV Adds Arista VeloCloud and FortiOS Flaws: Why CVSS Is the Wrong Sort Order

On 27 July 2026, CISA added two vulnerabilities to the Known Exploited Vulnerabilities catalog. One is a maximum-severity, unauthenticated command injection in an SD-WAN orchestrator. The other is a medium-severity information disclosure in a firewall operating system. If your patch queue is sorted by CVSS, the first one goes to the top of the list and the second one lands somewhere in the middle of next sprint.

That ordering is defensible on paper and wrong in practice, and the pairing is a useful illustration of why.

CVE-2026-16812: A CVSS 10.0 in the SD-WAN Management Plane

CVE-2026-16812 is an OS command injection flaw (CWE-78) in Arista's VeloCloud Orchestrator On-Prem, scored 10.0 under both CVSS v3.1 and v4.0. The root cause is architectural: privileged internal functionality that was only ever intended to be reachable by trusted internal components is exposed through the web interface. An attacker with network access to that interface needs no credentials, no user interaction, and faces low attack complexity to run arbitrary operating system commands on the orchestrator host.

What makes the orchestrator a consequential target is what it controls. Successful exploitation affects the confidentiality, integrity, and availability of the VCO itself and of the network data it manages, including connected VeloCloud Edge devices. An attacker who owns the orchestrator does not need to attack each branch appliance individually — they can modify configurations, read sensitive information, and disrupt SD-WAN management from a single position.

Arista confirmed the flaw was discovered externally and is being actively exploited, without disclosing when it was reported or how many customers were affected. Affected on-prem versions are those before 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1; the Hosted and Dedicated VCO offerings were patched ahead of public disclosure.

The detail worth acting on immediately: Arista published three IP addresses tied to the observed attacks — 8.19.75.217, 206.72.242.124, and 206.72.242.162 — and advised customers to block them and check logs for signs of compromise.

CVE-2025-68686: The Patch Bypass Nobody Sorts to the Top

The second addition is quieter and, for some organizations, more immediately dangerous. CVE-2025-68686 is an exposure of sensitive information flaw (CWE-200) in Fortinet FortiOS, scored CVSS 5.3. It affects FortiOS 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, and all 7.2, 7.0, and 6.4 releases, with fixes available in 7.6.2 and 7.4.7.

Its significance is not the score. It is a patch bypass that restores a symlink-based persistence technique used by attackers following an earlier FortiOS compromise. In other words: an organization that was breached, applied the original fix, and closed the incident may still be giving the original attacker read access to sensitive files on the device.

That condition — remediated on paper, persistent in reality — does not show up in a severity score. It shows up in the difference between "we patched" and "we verified the attacker is gone."

Why This Pairing Argues Against Severity-First Queues

Set the two side by side and the ranking inverts depending on your environment rather than on the CVEs:

• If you do not run VeloCloud Orchestrator On-Prem, the CVSS 10.0 is not your problem at all. It costs you a lookup in your asset inventory and nothing else.
• If you run FortiOS and have a prior compromise in your incident history, the CVSS 5.3 is an active persistence question that deserves attention this week, not next quarter.
• If you run both, the orchestrator wins on urgency because it is unauthenticated and remotely reachable — but the FortiOS check is cheap and answers a question about your existing incident records rather than about future risk.

The general principle: severity describes the vulnerability, exposure describes you. KEV membership tells you the exploitation is real, which removes the guesswork from the likelihood side, but it does not tell you whether the affected product sits on your perimeter. Only your own inventory does that.

This is also why CISA's risk-based directive framing matters more than the raw score. The agency set remediation deadlines for these entries — the FortiOS flaw by 10 August 2026 — and the underlying instruction is to prioritise security updates based on risk rather than on severity ranking alone.

The July 2026 Pattern: Edge and Identity Infrastructure

These two additions did not arrive in isolation. Across July 2026, KEV entries clustered around the same category of asset:

• Arista VeloCloud Orchestrator On-Prem — SD-WAN management plane, unauthenticated command injection.
• Fortinet FortiOS — SSL-VPN and firewall OS, persistence bypass.
• SonicWall SMA1000 appliances — CVE-2026-15409, an unauthenticated server-side request forgery scored CVSS 10.0, and CVE-2026-15410, a post-authentication code injection scored 7.2, both confirmed exploited as zero-days by SonicWall's own PSIRT.
• Microsoft Active Directory Federation Services — CVE-2026-56155, insufficient granularity of access control.
• Microsoft SharePoint Server — CVE-2026-56164, missing authentication for a critical function.

Remote access appliances, SD-WAN orchestrators, and federation services have one property in common: they are internet-reachable by design and they broker access to everything behind them. They are also the assets most likely to be excluded from endpoint tooling, which is precisely why compromise on them goes unnoticed.

Worth noting alongside this: Microsoft's July 2026 Patch Tuesday addressed a record 621 CVEs, two of them exploited as zero-days. A month that produces 621 fixes is a month in which severity-sorted queues guarantee that something exploited gets buried. Exploitation evidence is the only sort key that survives that volume.

What to Do This Week

The response splits cleanly into a patching track and a hunting track.

1. Establish exposure first. Query your inventory for VeloCloud Orchestrator On-Prem, FortiOS in the affected version ranges, SonicWall SMA1000, and internet-facing ADFS or SharePoint. Exposure determines everything downstream.
2. Patch to the fixed releases, not to "a newer version." Move VCO to a fixed 5.2, 6.1, 6.4, or 7.0 build; move FortiOS to 7.6.2 or 7.4.7 and migrate unsupported trains onto a supported one.
3. Block and hunt the published indicators. Arista's three IP addresses belong in your egress and ingress controls, and in a retrospective log query going back further than you think necessary.
4. Re-open closed FortiOS incidents. If a device was compromised before, verify the symlink persistence path specifically rather than trusting that the earlier patch resolved it.
5. Assume pre-patch compromise on anything KEV-listed and internet-facing. A KEV entry means exploitation preceded your patch window, so patching sets the end of the exposure window, not its beginning.

Turning KEV Into an Alert Instead of a Reading Task

The operational failure mode with KEV is not disagreement about its value — it is latency. A catalog update is only useful if somebody notices it, maps it against the estate, and reprioritises before the exploitation window closes. Done by hand, that is a weekly ritual at best.

CVE Watch exists to remove that step: declared products are matched against CVE records with their KEV and EPSS status attached, so a new exploited entry affecting something you run surfaces as a finding rather than as a headline you happened to read. Teams that pair that with EPSS-based prioritisation get an ordering that reflects exploitation probability rather than theoretical impact.

On the hunting side, vendor-published indicators are the highest-value starting point available and they are usually a short list. Run Arista's three addresses through IP reputation lookups to see hosting and ASN context alongside any prior malicious history, and check whatever else surfaces in appliance logs through bulk lookups rather than one tab at a time. Wiring that enrichment into your SIEM through the API means the next appliance alert arrives with the context already attached, which is the difference between a hunt and a habit.