As reported by CISA, two vulnerabilities have been formally added to the Known Exploited Vulnerabilities (KEV) Catalog, confirming active exploitation in the wild. For security teams, KEV additions are not bureaucratic housekeeping — they are operationally significant threat signals that demand immediate prioritization above standard patch cycles.

Security Impact: As reported by CISA, two vulnerabilities have been formally added to the Known Exploited Vulnerabilities (KEV) Catalog, confirming active exploitation in the wild.

Vulnerability Breakdown

CVE-2025-68686 — Fortinet FortiOS
Vulnerability Breakdown
Type: Exposure of Sensitive Information to an Unauthorized Actor
Vendor: Fortinet
Affected Product: FortiOS (specific versions pending vendor advisory confirmation)
Exploitation Status: Actively exploited in the wild (confirmed by CISA KEV)
Patch Available: Refer to Fortinet PSIRT advisory
Primary Risk: Unauthorized disclosure of sensitive system information, potentially enabling credential theft, lateral movement, or pre-attack reconnaissance
CVE-2026-16812 — Arista VeloCloud Orchestrator (On-Premises)
  • Type: OS Command Injection
  • Vendor: Arista Networks (VeloCloud)
  • Affected Product: VeloCloud Orchestrator On-Prem deployments
  • Exploitation Status: Actively exploited in the wild (confirmed by CISA KEV)
  • Patch Available: Refer to Arista/VeloCloud security advisory
  • Primary Risk: Full remote code execution on the orchestrator host — a catastrophic outcome in SD-WAN environments

Why This Combination Should Alarm Security Teams

What makes this KEV addition particularly concerning is the nature of both targets. FortiOS powers perimeter firewalls and VPN concentrators for tens of thousands of enterprises worldwide. An information disclosure vulnerability on this platform isn't just embarrassing — it's a potential stepping stone. Attackers harvesting sensitive data from FortiOS devices could be extracting session tokens, VPN credentials, or configuration details that enable deeper network access with minimal friction.

The Arista VeloCloud vulnerability carries a different but equally serious risk profile. SD-WAN orchestrators are high-value targets because they sit at the intersection of network visibility and policy control. A command injection flaw achieving code execution on the orchestrator doesn't just compromise one node — it potentially hands an attacker centralized control over branch connectivity, routing policy, and monitoring telemetry. In managed service provider (MSP) or multi-tenant environments, this could cascade across dozens of customer networks simultaneously.

Shield53 Assessment: OS command injection on a network orchestration platform is among the highest-severity real-world exploit chains we track. Combined with an information disclosure bug on the perimeter firewall, these two CVEs represent an attacker's toolkit for establishing initial access and then pivoting without detection.

Who Is Most at Risk

  • Federal agencies and government contractors — BOD 26-04 mandates urgent remediation; compliance timelines are not optional for FCEB entities
  • Enterprises running on-premises FortiOS firewalls with internet-facing management interfaces or SSL-VPN endpoints
  • Organizations using Arista VeloCloud Orchestrator in self-hosted (on-prem) deployments — cloud-managed instances may have different exposure, but should be confirmed with the vendor
  • MSPs and MSSPs managing VeloCloud infrastructure on behalf of customers — the blast radius of orchestrator compromise extends beyond the MSP itself
  • Critical infrastructure sectors — both Fortinet and VeloCloud have significant deployments in energy, healthcare, and financial services

Immediate Actions

For CVE-2025-68686 (FortiOS)

  • Review Fortinet's PSIRT portal immediately for affected FortiOS version ranges and apply available patches
  • Audit all internet-facing FortiOS management interfaces and SSL-VPN endpoints — restrict access to trusted IP ranges at minimum
  • Review FortiOS logs for anomalous access patterns or unauthorized information retrieval, particularly from unexpected source IPs
  • If patching is delayed, consider disabling non-essential services exposed externally as a temporary mitigation
  • Rotate any credentials or secrets that may have been accessible through the affected FortiOS interface

For CVE-2026-16812 (Arista VeloCloud Orchestrator)

  • Immediately assess whether your VeloCloud Orchestrator deployment is on-premises — cloud-hosted instances may not be affected but verify with Arista/VMware support
  • Apply vendor patches as the top priority; OS command injection with confirmed exploitation cannot wait on standard patch cadences
  • Restrict network access to the orchestrator management plane — limit to administrative subnets only via firewall rules or ACLs
  • Review orchestrator logs for unexpected command execution, new user accounts, or configuration changes initiated outside normal change windows
  • For MSPs: notify downstream customers and assess whether any customer-facing configurations were accessible to the orchestrator

Shield53 Recommendations

Beyond the immediate patch-and-detect response, this KEV addition reinforces a broader strategic imperative: network infrastructure devices are primary targets, not an afterthought. Too many organizations apply rigorous patch management to endpoints and servers while treating firewall firmware and SD-WAN orchestrators as "set and forget" infrastructure.

  • Establish a dedicated patch SLA for network infrastructure that matches or exceeds your endpoint patching timeline — 72 hours for KEV-listed vulnerabilities at minimum
  • Enable external attack surface monitoring to get alerting when network infrastructure components are exposed unexpectedly to the internet
  • Implement post-exploitation detection logic — BOD 26-04 now explicitly requires federal agencies to assess whether compromise occurred before a patch was applied; private sector organizations should adopt the same posture
  • Subscribe to Fortinet PSIRT and Arista Security Advisories via RSS or email to reduce detection lag on new vulnerabilities affecting your stack
  • Review your KEV exposure quarterly — run your asset inventory against the full KEV catalog, not just new additions

The KEV catalog remains one of the most actionable threat intelligence feeds available to defenders at no cost. Organizations that treat KEV additions as immediate operational triggers — rather than just compliance checkboxes — consistently demonstrate stronger resilience against real-world attack campaigns.