12OCT

Arista, Fortinet and Cisco flaws listed

1 min read

10:55UTC

CISA catalogued CVE-2026-16812 in Arista's VeloCloud Orchestrator and CVE-2025-68686 in Fortinet FortiOS on 27 July, then CVE-2026-20316 in Cisco's firewall console on 29 July.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

All three newly catalogued flaws sit in network management planes, not in end-user software.

CISA added two flaws to its federal exploited-vulnerability catalogue on 27 July and a third on 29 July⁠¹. Arista Networks supplied the first, an operating-system command injection in VeloCloud Orchestrator On-Prem, filed as CVE-2026-16812 and due for federal remediation by 30 July. Fortinet supplied the second, an exposure of sensitive information in FortiOS, filed as CVE-2025-68686 and due by 10 August. Cisco supplied the third, a hard-coded password in Secure Firewall Management Center, filed as CVE-2026-20316 and due by 1 August. A CVE identifier, short for Common Vulnerabilities and Exposures, is the industry's shared reference number for a specific flaw, and the catalogue lists only those CISA has confirmed attackers are already using.

The products themselves share a shape. VeloCloud Orchestrator manages wide-area network links across sites; Secure Firewall Management Center is the console from which Cisco firewall estates are configured; FortiOS runs the FortiGate firewalls that sit at organisational perimeters. None of the three is a workstation application. An intruder who reaches a network-management console does not need to move laterally afterwards, because the console already speaks to every device it administers. A listing date also marks confirmation rather than the onset of attacks: CrowdSec logged exploitation of Fortinet's FortiSandbox roughly a month before that flaw reached the catalogue.

A hard-coded password separates the Cisco entry from the other two. Such a credential is shipped inside the product and identical on every installation, so knowing it once is knowing it everywhere; there is no rotation an operator can perform and no configuration mistake to blame. That class of defect has no partial mitigation short of the vendor's fix or removal of the console from any network an attacker can reach.

Deep Analysis

In plain English

CISA added three more security flaws to its official list of vulnerabilities being actively exploited by hackers in the ten days after 24 July: a Cisco firewall-management flaw with a hard-coded password built into the software, an Arista networking flaw, and a Fortinet firewall issue. The Cisco flaw is notable because a hard-coded password isn't a bug you can configure your way around; the fix has to come from Cisco itself in a firmware update, which is part of why federal agencies were given just three days to act on it.

What could happen next?

Risk
A hard-coded password is a design defect, not a configuration gap, so no interim mitigation exists short of a firmware update from Cisco.

Sources:CISA

Mentions:CISA →Arista Networks →Fortinet →Cisco Secure Firewall Management Center →Cisco →FortiSandbox →CrowdSec →Known Exploited Vulnerabilities →Common Vulnerabilities and Exposures →

First Reported In

Update #12 · KEV deadlines fell from 14 days to three

CISA· 3 Aug 2026

Read original →

Causes and effects

Caused by

CISA tears up its KEV deadline rules

The three new KEV entries are catalogued under BOD 26-04's risk-tiered deadline allocation.

Occurred 10 Jun 2026

Read story →

This Event

Arista, Fortinet and Cisco flaws listed

All three flaws sit in the management plane of network equipment, the layer an intruder reaches for once perimeter access exists.

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.