CVE-2025-68686 & CVE-2026-16812: CISA KEV Alert — FortiOS and VeloCloud Critical Exploitation

---
title: FortiOS Suspicious Administrative API Access
id: 8c2f4d1e-5a6b-4c7d-9e1f-2b3a4c5d6e7f
status: experimental
description: Detects potential exploitation attempts of CVE-2025-68686 by identifying high-frequency or suspicious access to FortiOS API endpoints known to leak sensitive information.
references:
  - https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/07/27
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: fortinet
detection:
  selection:
    c-uri|contains:
      - '/api/v2/'
      - '/api/v3/cmdb/'
    sc-status: 200
  condition: selection
falsepositives:
  - Legitimate administrative management via API
level: high
---
title: Arista VeloCloud Orchestrator Command Injection
id: 9d3e5f2a-6b7c-4d8e-0f2a-3c4d5e6f7a8b
status: experimental
description: Detects potential exploitation of CVE-2026-16812 by identifying the VeloCloud web process spawning a shell, indicative of OS command injection.
references:
  - https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/07/27
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '/vco'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative debugging by authorized staff
level: critical

// Hunt for suspicious FortiOS API access patterns indicative of CVE-2025-68686
// Looks for high volume of GET requests to API endpoints from single sources
let FortiOSLogs = DeviceNetworkEvents
| where ActionType in ("NetworkConnectionAccepted", "NetworkConnectionCreated")
| where RemotePort in (443, 10443)
| where InitiatingProcessFileName has "fortinet" or DeviceName contains "forti";
FortiOSLogs
| summarize count() by SrcIpAddr, Bin(TimeGenerated, 5m)
| where count_ > 50 // Threshold tuning required based on traffic baselines
| project SrcIpAddr, TimeGenerated, count_
| extend AlertMessage = "High frequency FortiOS API access detected"
;
// Hunt for VeloCloud Orchestrator exploitation (CVE-2026-16812)
// Detects web server processes spawning shells
DeviceProcessEvents
| where InitiatingProcessFileName has "java" or InitiatingProcessFileName has "vco"
| where FileName in ("sh", "bash", "dash", "zsh")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, CommandLine, FileName
| extend AlertMessage = "VeloCloud process spawning shell - Potential RCE"

// Hunt for signs of VeloCloud Command Injection (CVE-2026-16812)
// Identify parent Java/VCO processes spawning unauthorized shells
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Name =~ 'sh' OR Name =~ 'bash'
  AND Ppid IN (
    SELECT Pid FROM pslist() WHERE Name =~ 'java' OR Name =~ 'vco'
  )

// Hunt for FortiOS (if running on supported VM environments) unusual network connections
SELECT Fd, Family, RemoteAddr, RemotePort, State, ProcessName
FROM netstat()
WHERE ProcessName =~ 'fortigate' OR ProcessName =~ 'fortiOS'
  AND State =~ 'ESTABLISHED'
  AND RemotePort IN (443, 10443)

#!/bin/bash

# Remediation/Hardening Check for CVE-2026-16812 (VeloCloud)
# This script checks for the VeloCloud service status and listening interfaces.

echo "[+] Checking for VeloCloud Orchestrator services..."

# Identify running VeloCloud processes
VCO_PID=$(pgrep -f "vco" | head -n 1)

if [ -z "$VCO_PID" ]; then
    echo "[-] No VeloCloud Orchestrator process detected."
    exit 0
else
    echo "[!] VeloCloud Orchestrator detected running with PID: $VCO_PID"
fi

# Check listening ports (VCO typically uses 80, 443, 9002, etc.)
echo "[+] Checking open network sockets associated with VeloCloud..."
netstat -tulpn 2>/dev/null | grep "$VCO_PID"

# Warning if exposed to 0.0.0.0
if netstat -tulpn 2>/dev/null | grep "$VCO_PID" | grep -q "0.0.0.0"; then
    echo "[!] WARNING: VeloCloud is listening on 0.0.0.0."
    echo "[!] ACTION REQUIRED: Restrict access via host firewall (iptables/nftables) immediately."
    echo "[!] Example iptables rule to limit access to management subnet:"
    echo "    iptables -A INPUT -p tcp --dport 443 -s <MANAGEMENT_SUBNET> -j ACCEPT"
    echo "    iptables -A INPUT -p tcp --dport 443 -j DROP"
fi

echo "[+] Remediation: Apply vendor patches for CVE-2026-16812 immediately."
echo "[+] Refer to Arista Security Advisory for specific patch versions."