CISA Adds Exploited Flaws in FortiOS and VeloCloud Orchestrator to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming that both flaws are being actively exploited in cyberattacks.
The first vulnerability, CVE-2026-16812, resides in the on-premises edition of Arista VeloCloud Orchestrator, an SD-WAN management product. It is an OS command injection flaw that grants attackers access to internal functions normally reserved for privileged users. Successful exploitation can result in leakage or tampering of the orchestrator itself and managed data, as well as denial-of-service conditions. The flaw received the maximum CVSS v3.1 base score of 10.0 and is rated Critical. CISA set a remediation deadline of July 30 for US federal agencies.
The second vulnerability, CVE-2025-68686, affects Fortinet FortiOS, the operating system used on Fortinet network devices. It permits attackers to bypass certain security patches and exfiltrate sensitive information. Exploitation requires prior access to the target file system and is typically combined with another vulnerability. Federal agencies must address this issue by August 10.
CISA published the updates on July 27 and urged organizations to apply available mitigations immediately.
Related articles
Top Cybersecurity Stories of the Week: WordPress XSS Flaw, Microsoft Patch Tuesday, Cisco Zero-Day and More
Security NEXT has published its weekly ranking of the most viewed articles between August 9 and August 15 2026. The list is dominated by critical vulnerabilities affecting widely deployed platforms including WordPress, Microsoft products, Cisco networking gear and Fortinet FortiOS. A cross-site scripting issue in the WordPress login screen and a remote code execution flaw in WordPress 7.0.4 both received immediate patches. Microsoft released updates addressing more than 400 vulnerabilities, while Cisco disclosed a zero-day denial-of-service flaw in its SSL VPN implementation. Additional high-impact issues were reported in FortiOS, Google Chrome, Zoom and Jenkins, prompting urgent remediation guidance from vendors.
Critical Vulnerability CVE-2026-8715 Discovered in HashiCorp Vault Secrets Operator
HashiCorp has disclosed a critical vulnerability in its Vault Secrets Operator product that affects the AppRole authentication mechanism introduced in version 1.3.0. The flaw, tracked as CVE-2026-8715, stems from insufficient path validation in the secretIDPath field, allowing authenticated Kubernetes users to read arbitrary files from Pod filesystems. With a CVSS v3.1 base score of 9.6, the issue is rated Critical and can lead to credential theft by exfiltrating secrets to attacker-controlled endpoints. Exploitation requires specific permissions to create or retrieve VaultAuth, VaultConnection, and VaultStaticSecret resources. HashiCorp recommends immediate migration to version 1.5.0, which removes the vulnerable secretIDPath field entirely.
What Is an Exploit: How a Flaw in Someone Else's Code Becomes Unauthorized Access to Your Server
The article explains the critical distinction between a vulnerability and an exploit using the Log4Shell incident as the primary example. It breaks down how Log4j's JNDI lookup flaw allowed remote code execution simply by logging a crafted string, leading to CVE-2021-44228 with a maximum CVSS score. The piece covers the full lifecycle from vulnerability discovery to payload delivery, including memory corruption, injection flaws, and logical errors. It details defensive mechanisms such as stack canaries, DEP, ASLR, and CFG, along with attacker responses like ROP chains. Real-world cases including Zerologon, Heartbleed, Stuxnet, and WannaCry illustrate the progression from single bugs to multi-stage exploit chains. The text also addresses zero-day economics, exploit kits, bug bounty programs, and practical mitigation strategies centered on KEV catalogs and EPSS scoring.
AMD Memory Controller PoC Bypasses Hardware Isolation on Family 16h Processors
Security researcher Christopher Domas released a proof-of-concept project named skitter-creek-bath-salts that demonstrates a bypass of hardware memory protections on AMD Family 16h processors. The technique manipulates DRAM controller settings to access regions that should remain inaccessible even to the operating system, kernel, and ring-0 code. By altering a single register after upstream protections have acted, the controller remaps addresses, creating an alias that leads to the same DRAM cells through an alternative path. The PoC uses linear algebra and the Z3 SMT solver to locate alias addresses and carefully manages interrupts, cache, and page tables to avoid system crashes during the brief remapping window. Demonstrations include potential access to the AMD Platform Security Processor, fTPM data, System Management Mode regions, C6 processor states, and microcode storage, with the possibility of modifying microcode patches. The research was validated only on AMD Family 16h; no similar issues have been reported for newer AMD, Intel, ARM, or RISC-V platforms.