Vulnerability intelligence

CVE-2026-16812 is an OS command injection vulnerability found in Arista Networks VeloCloud Orchestrator (VCO) On-Prem. This flaw allows a remote attacker to execute operating system commands on the VCO host. The vulnerable functionality was originally intended for internal use only but remained remotely accessible. Successful exploitation of CVE-2026-16812 can lead to a compromise of the confidentiality, integrity, and availability of the orchestrator and the data it manages. This vulnerability does not require authentication for exploitation and has been actively exploited in the wild.

CVE-2025-68686 is an information disclosure vulnerability affecting multiple versions of Fortinet FortiOS, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200). This flaw allows a remote, unauthenticated attacker to bypass a previously implemented patch designed to address a symbolic link persistency mechanism. The bypass is achieved through specially crafted HTTP requests, which can lead to the exposure of sensitive data. It is important to note that CVE-2025-68686 acts as a secondary exploitation vector. For this vulnerability to be leveraged, the FortiOS product must have already been compromised at the filesystem level through a separate, prior vulnerability. This means the vulnerability extends the impact of previous compromises by allowing attackers to maintain unauthorized access to sensitive information on already affected FortiOS devices.

CVE-2026-49176 is a local privilege escalation vulnerability found in the Microsoft Windows WalletService component. This flaw stems from improper privilege management combined with link-following behavior (CWE-59). An authorized local attacker can exploit this vulnerability to gain SYSTEM-level privileges on affected Windows client and server editions. The WalletService, which manages wallet-related objects and credentials, performs privileged file or object operations without adequately validating the identity or trust boundary of resources it interacts with. Because the service operates with elevated rights, a standard local user can influence these operations to act on attacker-controlled paths, often involving symbolic links, junctions, or mount points. Microsoft addressed this issue through its security update guide, and a public proof-of-concept has been published on GitHub.

CVE-2026-16812 is an OS command injection vulnerability found in Arista Networks VeloCloud Orchestrator (VCO) On-Prem. This flaw allows a remote attacker to execute operating system commands on the VCO host. The vulnerable functionality was originally intended for internal use only but remained remotely accessible. Successful exploitation of CVE-2026-16812 can lead to a compromise of the confidentiality, integrity, and availability of the orchestrator and the data it manages. This vulnerability does not require authentication for exploitation and has been actively exploited in the wild.

CVE-2025-68686 is an information disclosure vulnerability affecting multiple versions of Fortinet FortiOS, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200). This flaw allows a remote, unauthenticated attacker to bypass a previously implemented patch designed to address a symbolic link persistency mechanism. The bypass is achieved through specially crafted HTTP requests, which can lead to the exposure of sensitive data. It is important to note that CVE-2025-68686 acts as a secondary exploitation vector. For this vulnerability to be leveraged, the FortiOS product must have already been compromised at the filesystem level through a separate, prior vulnerability. This means the vulnerability extends the impact of previous compromises by allowing attackers to maintain unauthorized access to sensitive information on already affected FortiOS devices.

CVE-2026-50522 is identified as a deserialization vulnerability affecting Microsoft Office SharePoint. This flaw enables an unauthorized attacker to execute code remotely over a network. The vulnerability was addressed as part of Microsoft's July 2026 Patch Tuesday updates.