CVE-2026-16812

CVE: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability: Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
CWE: CWE-78
Published: Arista | VeloCloud Orchestrator
Link: https://www.cve.org/CVERecord?id=CVE-2026-16812

Threat Analysis (Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability: Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.)

  1. Impact: The OS command injection allows a remote attacker to execute arbitrary commands on the VeloCloud Orchestrator (VCO) host, potentially reading or modifying configuration files, stealing data, or disrupting orchestration services. This compromises Confidentiality (data exposure), Integrity (tampered configs), and Availability (service interruption).

  2. Affected Components & Attack Surface: Vulnerable software version is the VCO on‑premise OS (typically Linux) running the VeloCloud Orchestrator service; the attack surface is remote via HTTP/HTTPS request handling (e.g., management APIs).

  3. Exploitation Prerequisites: Minimal assumptions – a remote network host with internet access to the VCO’s management URL and no authentication or role restrictions on the target service.

  4. Detection Ideas & Indicators: Logs from VCO management server showing unexpected command execution (e.g., “bash -c ‘…’” entries), ATT&CK T1059.005 (OS Command - Bash), unusual outbound traffic to internal IPs, or failed authentication attempts.

  5. Mitigations & Workarounds: Apply the latest VeloCloud firmware patch, disable remote management interfaces, enforce strict network segmentation, or restrict API access to known IPs only.

  6. Verification Steps: From a controlled host, send a crafted request containing a payload like ?cmd=whoami and verify that the server returns the command’s output instead of a standard response, confirming command injection.

  7. Attack‑Path Sequence

    sequenceDiagram
 participant Attacker
 participant VCO
 Attacker->>VCO: HTTP/HTTPS request with payload
 VCO->>VCO: Execute injected command
 VCO-->>Attacker: Command output / data

CVE-2025-68686

CVE: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability: Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
CWE: CWE-200
Published: Fortinet | FortiOS
Link: https://www.cve.org/CVERecord?id=CVE-2025-68686

Threat Analysis (Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability: Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.)

  1. Impact: Remote unauthenticated attackers can read sensitive configuration or data, compromising Confidentiality. No direct impact on Integrity or Availability.

  2. Affected Components & Attack Surface: FortiOS web UI, FortiManager API, and the symbolic‑link persistency mechanism exposed via HTTP requests. Exposure is remote; no local file access required.

  3. Exploitation Prerequisites: An attacker must first gain filesystem‑level compromise of the FortiOS device. After that, a crafted HTTP GET request to the vulnerable endpoint triggers data leakage without authentication.

  4. Detection Ideas & Indicators: Syslog entries showing GET requests to /api/.../sensitive with unexpected user‑agents. ID CVE‑2025‑68686 in FortiOS audit logs. MITRE ATT&CK T1040 (Exfiltration of Data).

  5. Mitigations & Workarounds: Deploy FortiOS 7.4.2+ patch, disable the symbolic‑link persistency API, remove the exposed endpoint, enforce TLS, and segment the management network.

  6. Verification Steps: From a client machine, issue a crafted HTTP GET to the vulnerable URL; if the response contains sensitive data, the CVE is active. After applying the patch, the same request returns 403 Forbidden.

  7. Attack‑Path Sequence

    sequenceDiagram
 participant CompromisedDevice
 participant HTTPAttacker
 participant FortiOS
 CompromisedDevice->>HTTPAttacker: File‑system breach
 HTTPAttacker->>FortiOS: Crafted HTTP GET
 FortiOS->>HTTPAttacker: Returns sensitive data
 note right of HTTPAttacker: Data exfiltration

CVE-2026-50522

CVE: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability : Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.
CWE: CWE-502
Published: Microsoft | SharePoint
Link: https://www.cve.org/CVERecord?id=CVE-2026-50522

Threat Analysis (Microsoft SharePoint Deserialization of Untrusted Data Vulnerability : Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.)

  1. Impact: Remote code execution can compromise confidentiality (data theft), integrity (malformed files), and availability (service disruption) by allowing an attacker to run arbitrary commands on the SharePoint server.

  2. Affected Components & Attack Surface: SharePoint server components exposed via HTTP (e.g., OData services, web parts) and any untrusted data deserialization point; the attack surface is remote.

  3. Exploitation Prerequisites: No authentication required; an attacker must send a crafted HTTP request containing untrusted serialized data that triggers deserialization.

  4. Detection Ideas & Indicators: Look for anomalous OData request logs, unexpected file writes, or PowerShell commands; MITRE ATT&CK T1195 (Deserialization) and CVE‑2026‑50522 ID.

  5. Mitigations & Workarounds: Deploy the latest SharePoint patch, disable or restrict OData services, and enforce a Web Application Firewall to block untrusted payloads.

  6. Verification Steps: Send a malicious serialized payload to a vulnerable OData endpoint; if PowerShell or shell code executes, the vulnerability is confirmed.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>SharePoint: HTTP request with untrusted serialized data
 SharePoint->>SharePoint: Deserialize payload
 SharePoint->>SharePoint: Execute arbitrary code
 SharePoint->>Attacker: Return success/response

CVE-2026-16232

CVE: Check Point SmartConsole Improper Authentication Vulnerability: Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.
CWE: CWE-287
Published: Check Point | SmartConsole
Link: https://www.cve.org/CVERecord?id=CVE-2026-16232

Threat Analysis (Check Point SmartConsole Improper Authentication Vulnerability: Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.)

  1. Impact: Unauthenticated remote attacker can obtain an application login token that grants full administrative privileges on the Check Point SmartConsole, leading to complete confidentiality, integrity, and availability breaches (e.g., unauthorized data access, configuration changes, denial of service via privilege escalation).

  2. Affected Components & Attack Surface: The vulnerability resides in the SmartConsole web interface of Check Point products; exposed via HTTP/HTTPS on port 443 (or 8443) to unauthenticated external users. No specific version is required for the flaw.

  3. Exploitation Prerequisites: A remote attacker with no authentication credentials must exploit the authentication bypass to receive a valid admin token; no additional privileges or configuration are needed beyond network access.

  4. Detection Ideas & Indicators: Monitor SmartConsole login‑token requests for anomalous spikes, log “Invalid token” or “Token revoked” events, and look for privileged account usage without prior authentication (MITRE ATT&CK T1078). Alert on repeated failed authentication attempts to the web UI.

  5. Mitigations & Workarounds: Deploy the vendor patch (CVE‑2026‑16232) as soon as available, disable remote SmartConsole access if not required, enforce MFA for admin accounts, and restrict the web interface to trusted IP ranges.

  6. Verification Steps: Capture a token via the exploit, attempt to use it to log in with full admin rights, and confirm the token is valid. Verify the product version is patched (check‑point‑smartconsole version ≥ X.Y.Z) and that the token request is blocked.

  7. Attack‑Path Sequence:

sequenceDiagram
    Attacker->>SmartConsole: Send crafted request to /auth
    SmartConsole->>Web Server: Process request (bypass auth)
    Web Server->>Attacker: Return admin token
    Attacker->>SmartConsole: Use token to login
    SmartConsole->>Admin: Grant full admin session

CVE-2021-27137

CVE: DD-WRT Stack-Based Buffer Overflow Vulnerability: DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.
CWE: CWE-121
Published: DD-WRT | DD-WRT
Link: https://www.cve.org/CVERecord?id=CVE-2021-27137

Threat Analysis (DD-WRT Stack-Based Buffer Overflow Vulnerability: DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.)

  1. Impact: A stack‑based buffer overflow in DD‑WRT’s UPnP handling can enable remote code execution, leading to loss of confidentiality (data theft), integrity (malicious modifications), and availability (service disruption or denial).

  2. Affected Components & Attack Surface: The vulnerability resides in the DD‑WRT router firmware (all vulnerable stack versions). Attack surface is remote – an unauthenticated attacker can send crafted UPnP HTTP/UPnP requests.

  3. Exploitation Prerequisites: No privileged credentials required; only an unauthenticated network connection with the ability to send a malformed UPnP request (e.g., oversized payload) is needed.

  4. Detection Ideas & Indicators: Look for HTTP 500 errors or error logs from UPnP processing; ATT&CK IDs T1190 (Exploit Public‑Facing Application) and T1195 (Remote Code Execution). Monitor for unusually large UPnP payloads or stack‑overflow‑specific kernel messages.

  5. Mitigations & Workarounds: Apply the vendor‑published firmware patch that fixes the buffer overflow. Alternatively, disable UPnP or limit it to a trusted LAN segment.

  6. Verification Steps: After installing the patch, confirm the firmware version no longer lists CVE‑2021‑27137. Send a crafted oversized UPnP request and verify the router returns a standard error (e.g., 400 Bad Request) rather than executing code.

  7. Attack‑Path Sequence (Mermaid):

    graph TD
 A[Attacker sends crafted UPnP request] --> B[Router processes request]
 B --> C[Stack overflow in internal buffer]
 C --> D[Code execution]
 D --> E[Privileged attacker control]