Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

U.S. CISA adds Arista VeloCloud Orchestrator and Fortinet FortiOS flaws to its Known Exploited Vulnerabilities catalog

Part of the CVE-2025-68686 story · since 11 Feb

Quiet for 14 weekslast report 28 Jul5 articles4 outlets
11 Feb · SecurityWeek first24 Jun8 Aug22 SepNowThis article5th of 5
  • Wed 11 Feb, 10:05 UTC. SecurityWeek, first report. Fortinet Patches High-Severity Vulnerabilities. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 22:32 UTC. SecurityOnline, its first report on the story. CISA adds Arista VeloCloud RCE and Fortinet FortiOS bypass to KEV. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 22:51 UTC. CISA, its first report on the story. CISA adds FortiOS info leak CVE-2025-68686 to KEV, urges patch. Cites a CVE in CISA KEV.
  • Tue 28 Jul, 08:46 UTC. CISA. Fortinet FortiOS bug CVE-2025-68686 exposes data to hackers. Cites a CVE in CISA KEV.
  • Tue 28 Jul, 09:01 UTC. Security Affairs, its first report on the story. U.S. CISA adds Arista VeloCloud Orchestrator and Fortinet FortiOS flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV. This article, 5th of 5.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2025-68686 affecting Fortinet FortiOS, which has a CVSS score of 5.3, and CVE-2026-16812 impacting Arista VeloCloud Orchestrator, rated at 10.0. The Fortinet issue allows unauthorized access to sensitive information post-compromise, while the Arista bug could let attackers invoke privileged functions, jeopardizing network data integrity.

Federal agencies must fix these vulnerabilities by specific deadlines: July 20, 2026, for Arista and August 10, 2026, for Fortinet. Organizations are advised to apply security updates promptly and review the KEV catalog.

How the story developed

All 5 articles
Quiet for 14 weekslast report 28 Jul5 articles4 outlets

5 articles from 4 outlets since 11 Feb. Quiet since 28 Jul. This was the 5th report, 167 days after the first.

Now11 Feb121425 Jul2830First reportSecurityWeek · 11 Feb, 10:05This article5th of 5 · day 167
  • Wed 11 Feb, 10:05 UTC. SecurityWeek, first report. Fortinet Patches High-Severity Vulnerabilities. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 22:32 UTC. SecurityOnline, its first report on the story. CISA adds Arista VeloCloud RCE and Fortinet FortiOS bypass to KEV. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 22:51 UTC. CISA, its first report on the story. CISA adds FortiOS info leak CVE-2025-68686 to KEV, urges patch. Cites a CVE in CISA KEV.
  • Tue 28 Jul, 08:46 UTC. CISA. Fortinet FortiOS bug CVE-2025-68686 exposes data to hackers. Cites a CVE in CISA KEV.
  • Tue 28 Jul, 09:01 UTC. Security Affairs, its first report on the story. U.S. CISA adds Arista VeloCloud Orchestrator and Fortinet FortiOS flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV. This article, 5th of 5.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 5 articles as a list
  1. Wed 11 FebDay 01
    1. Fortinet Patches High-Severity Vulnerabilities10:05 · SecurityWeek · First report · Exploited CVE · Known exploited CVE

  2. Quiet for 24 weeks

    Mon 27 JulDay 1662
    1. CISA adds Arista VeloCloud RCE and Fortinet FortiOS bypass to KEV22:32 · SecurityOnline · Picked up again · Known exploited CVE
    2. CISA adds FortiOS info leak CVE-2025-68686 to KEV, urges patch22:51 · CISA · official · CISA alert · Known exploited CVE
  3. Tue 28 JulDay 1672
    1. Fortinet FortiOS bug CVE-2025-68686 exposes data to hackers08:46 · CISA · official · Known exploited CVE
    2. U.S. CISA adds Arista VeloCloud Orchestrator and Fortinet FortiOS flaws to its Known Exploited Vulnerabilities catalog09:01 · Security Affairs · Known exploited CVE · This article, 5th of 5

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in