Arista Networks published Security Advisory 0144 on Monday disclosing CVE-2026-16812, an OS command injection vulnerability in VeloCloud Orchestrator On-Premises that carries CVSS scores of 10.0 under both v3.1 and v4.0 frameworks. The flaw allows a remote unauthenticated attacker to reach privileged internal functionality in the orchestrator that was designed for internal use only and was never intended to be externally accessible. Arista confirmed the vulnerability was discovered externally and is known to be actively exploited in the wild. No credentials, no authentication token, and no user interaction are required. The CVSS vector is fully network-accessible, low complexity, no privileges required, and no user interaction needed, with high confidentiality, integrity, and availability impact on both the orchestrator and surrounding scope. Arista explicitly warns that compromises to the VCO platform may allow attackers access to VeloCloud Edge devices and urges customers who identify a compromised orchestrator to rotate credentials, review administrator activity, validate managed device state, and restore or replace affected instances from trusted sources. The flaw affects VeloCloud Orchestrator On-Prem across its supported release branches. Fixed versions are 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1. Hosted and dedicated cloud VCO deployments were patched before the advisory was published. On-premises deployments are the only affected class. CISA added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog today and set a federal remediation deadline of July 30, one of the shortest windows CISA has set this year alongside the two-day Check Point deadline from Issue 92. The CISA KEV entry includes a specific forensics triage requirement, citing its guidance on forensic triage methods that should accompany remediation when exploitation is confirmed.

JetBrains published its advisory today for CVE-2026-63077, a critical unauthenticated remote code execution vulnerability in TeamCity On-Premises. The root cause is insecure deserialization of untrusted data in the agent polling protocol, the communication channel that TeamCity On-Premises uses to receive job requests and configuration updates from build agents. An attacker with HTTP or HTTPS access to the TeamCity server can send a crafted deserialization payload to this endpoint without any credentials, session token, or prior authentication. Successful exploitation allows the attacker to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. Depending on how the server process is configured, this gives the attacker access to TeamCity data and build configurations, stored secrets and API tokens embedded in build configurations, source code repositories connected to the server, and the ability to modify server state including adding new users or modifying access controls. The vulnerability affects all TeamCity On-Premises versions without a lower bound. Every historical release is in scope. JetBrains fixed the issue in versions 2025.11.7 and 2026.1.3. For organizations that cannot immediately upgrade, JetBrains released a security patch plugin compatible with version 2017.1 and later that addresses this specific CVE without requiring a full version upgrade. TeamCity Cloud is not affected. No exploitation in the wild has been confirmed as of today, but the IONIX research team noted it is tracking exploitation attempts.

CISA added CVE-2025-68686 to its Known Exploited Vulnerabilities catalog today alongside the Arista VeloCloud entry. CVE-2025-68686 is a medium-severity (CVSS 5.3) vulnerability in Fortinet FortiOS that Fortinet patched in February 2025. The flaw is a bypass of patches applied to three prior FortiOS SSL-VPN vulnerabilities: CVE-2022-42475, a heap buffer overflow exploited by state-sponsored actors from late 2022; CVE-2023-27997, a heap buffer overflow in the SSL-VPN module exploited in pre-authentication attacks and used for initial access in ransomware campaigns through 2023 and 2024; and CVE-2024-21762, an out-of-bounds write exploited as a zero-day beginning in late 2024. All three were added to CISA KEV during their respective active exploitation periods. CVE-2025-68686 allows an attacker who would have been blocked by those prior patches to bypass the fix and reach the same underlying vulnerable behavior through a different code path. Fortinet patched CVE-2025-68686 in February 2025. CISA's KEV addition today confirms that despite the February patch, exploitation in the wild is ongoing.