{"metadata": {"vulnerability": "CVE-2026-16812", "count": 101, "kinds": {"milestone": 5, "sighting": 71, "kev": 11, "other": 14}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0281", "record": "NCSC-2026-0281", "field": "document.tracking.generator.date"}, {"timestamp": "2026-07-23T21:46:32.558Z", "date_only": false, "value": "2026-07-23T21:46:32.558Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-16812", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-27T00:00:00Z", "date_only": false, "value": "2026-07-27T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-16812", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "7c882d21-a5e5-4284-a2a2-e3af479640a0", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-27T00:00:00Z", "date_only": true, "value": "2026-07-27", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-16812", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-07-27T00:00:00Z", "date_only": true, "value": "2026-07-27", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-16812", "field": "evidence.0.details.date_added", "uuid": "7c882d21-a5e5-4284-a2a2-e3af479640a0", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-27T00:00:00Z", "date_only": false, "value": "2026-07-27T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-16812", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "7c882d21-a5e5-4284-a2a2-e3af479640a0", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-27T00:00:00Z", "date_only": false, "value": "2026-07-27T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-16812", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-27T00:00:00Z", "date_only": false, "value": "2026-07-27T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-16812", "record": "FKIE_CVE-2026-16812", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-27T00:00:00Z", "date_only": false, "value": "2026-07-27T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-16812", "field": "status.status_updated_at", "uuid": "7c882d21-a5e5-4284-a2a2-e3af479640a0", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-27T00:00:00Z", "date_only": false, "value": "2026-07-27T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-16812", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-07-27T15:26:58.277Z", "date_only": false, "value": "2026-07-27T15:26:58.277989Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mrn7h6zcl32w", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "5660b20f-00e9-40bd-a7f0-915ab3d958d7", "content": "CVE-2026-16812, a VeloCloud command injection scored CVSS 10, is exploited in the wild. Patch VeloCloud Orchestrator now, plus two related bugs.\n\n#VeloCloud #Arista #CVE202616812 #CommandInjection #ExploitedInTheWild #VCO #SSRF #Cybersecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mrn7h6zcl32w"}, {"timestamp": "2026-07-27T16:07:00Z", "date_only": false, "value": "2026-07-27T16:07:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / Arista", "record": "CVE-2026-16812", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-27T16:11:00.968Z", "date_only": false, "value": "2026-07-27T16:11:00.968Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-16812", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-27T16:11:00.968Z", "date_only": false, "value": "2026-07-27T16:11:00.968Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Arista", "record": "CVE-2026-16812", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-27T16:17:03Z", "date_only": false, "value": "2026-07-27T16:17:03Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F2CP-Q2QV-6563", "record": "GHSA-F2CP-Q2QV-6563", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-07-27T16:17:03.640Z", "date_only": false, "value": "2026-07-27T16:17:03.640", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-16812", "record": "FKIE_CVE-2026-16812", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-27T16:20:55Z", "date_only": false, "value": "2026-07-27T16:20:55+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2026-16812", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "0ab0b145-d51f-447c-8ca9-a77176d7904b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-27T16:20:55Z", "date_only": false, "value": "2026-07-27T16:20:55+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2026-16812", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "0ab0b145-d51f-447c-8ca9-a77176d7904b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-27T16:20:55Z", "date_only": false, "value": "2026-07-27T16:20:55+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2026-16812", "field": "status.status_updated_at", "uuid": "0ab0b145-d51f-447c-8ca9-a77176d7904b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-27T16:20:55.359Z", "date_only": false, "value": "2026-07-27T16:20:55.359Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2026-16812", "field": "evidence.0.details.added_date", "uuid": "0ab0b145-d51f-447c-8ca9-a77176d7904b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-27T17:00:01Z", "date_only": false, "value": "2026-07-27T17:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2026-16812", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "0ab0b145-d51f-447c-8ca9-a77176d7904b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-27T17:00:21.845Z", "date_only": false, "value": "2026-07-27T17:00:21.845229Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0ab0b145-d51f-447c-8ca9-a77176d7904b", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "e4e9b4d1-e5a5-4227-b271-267160ce2927", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0ab0b145-d51f-447c-8ca9-a77176d7904b", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-27T18:02:04.485Z", "date_only": false, "value": "2026-07-27T18:02:04.485590Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrni4kpbif2e", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "cc31dc01-323d-4c2c-aa44-0b38ce7c8f6c", "content": "CVE-2026-16812 - velocloud orchestrator on-prem\nThe VeloCloud Orchestrator, a software used for network management, has a security flaw that could allow an attacker to access internal features remotely. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#aristanetworks #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mrni4kpbif2e"}, {"timestamp": "2026-07-27T18:31:47Z", "date_only": false, "value": "2026-07-27T18:31:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F2CP-Q2QV-6563", "record": "GHSA-F2CP-Q2QV-6563", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-27T19:40:56.076Z", "date_only": false, "value": "2026-07-27T19:40:56.076556Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mrnnnd5c7p2n", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "1d988107-e900-4472-b000-e1edcd97f569", "content": "\ud83d\uded1 CVE-2026-16812\nArista VeloCloud Orchestrator\nCVSS 10.0 / KEV: No\nTL;DR: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a\u2026\nhttps://cvesentinel.com/report/CVE-2026-16812?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mrnnnd5c7p2n"}, {"timestamp": "2026-07-27T20:00:01Z", "date_only": false, "value": "2026-07-27T20:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-16812", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "7c882d21-a5e5-4284-a2a2-e3af479640a0", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-27T20:00:02.529Z", "date_only": false, "value": "2026-07-27T20:00:02.529342Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7c882d21-a5e5-4284-a2a2-e3af479640a0", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "92f0a3bc-6be4-43de-9257-bea6f8f524c8", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7c882d21-a5e5-4284-a2a2-e3af479640a0", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-27T20:03:08.354Z", "date_only": false, "value": "2026-07-27T20:03:08.354488Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mrnouzhmbo2o", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "3b24d663-62f2-4d1a-9a95-971a0dc3494e", "content": "\ud83d\uded1 CVE-2026-16812\nArista VeloCloud Orchestrator\nCVSS 10.0 / KEV \u2705\nTL;DR: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a r\u2026\nhttps://cvesentinel.com/report/CVE-2026-16812?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mrnouzhmbo2o"}, {"timestamp": "2026-07-27T20:11:21.185Z", "date_only": false, "value": "2026-07-27T20:11:21.185937Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mrnpdp3xqx22", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "6b6979f6-8195-4b9d-a258-73d779888c76", "content": "\ud83d\udd34 EXPLOITED\n\nOn-prem VeloCloud Orchestrator has a max-severity bug (CVE-2026-16812): a remote attacker runs commands on your SD-WAN control server, no login.\n\nCISA confirms it is exploited.\n\nPatch to 5.2.3.14 / 6.1.3.4 / 6.4.2.4 / 7.0.0.1 now.", "url": "https://bsky.app/profile/suriq.io/post/3mrnpdp3xqx22"}, {"timestamp": "2026-07-27T21:31:21Z", "date_only": false, "value": "2026-07-27T21:31:21Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F2CP-Q2QV-6563", "record": "GHSA-F2CP-Q2QV-6563", "field": "modified"}, {"timestamp": "2026-07-27T21:54:22.108Z", "date_only": false, "value": "2026-07-27T21:54:22.108313Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mrnv3wfrfm2x", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "da930c5c-06d5-4dcb-ac77-b30a7d07e25d", "content": "CISA KEV additions on July 27 flag two known exploited vulnerabilities: Arista VeloCloud CVE-2026-16812 and FortiOS CVE-2025-68686. Patch both now.\n\n#CISA #KEV #Arista #VeloCloud #Fortinet #FortiOS #CVE #ExploitedInTheWild #Cybersecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mrnv3wfrfm2x"}, {"timestamp": "2026-07-28T00:48:07.663Z", "date_only": false, "value": "2026-07-28T00:48:07.663434Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mro6sm3vb22y", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "34b58a14-55db-4e4c-a057-74591b9f5a4c", "content": "CVE-2026-16812 Exposed Arista VeloCloud Orchestrator: Immediate Action Required #CyberSecurity #Vulnerability #CVE2026", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mro6sm3vb22y"}, {"timestamp": "2026-07-28T00:49:10.304Z", "date_only": false, "value": "2026-07-28T00:49:10.304854Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mro6uf5th32j", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "55db9e9e-632b-415b-a3f3-03001dcbea8e", "content": "CVE-2026-16812: Arista's VeloCloud Orchestrator Zero-Day Breach Shows Critical Flaw #CVE2026 #CyberSecurity #ZeroDay", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mro6uf5th32j"}, {"timestamp": "2026-07-28T00:49:11.644Z", "date_only": false, "value": "2026-07-28T00:49:11.644317Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mro6uhamur2u", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "2b012be5-458d-4e2c-9894-c740cb1afc93", "content": "CVE-2026-16812: Arista's Critical Patch Raises Questions on Security Practices #CVE2026 #Arista #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mro6uhamur2u"}, {"timestamp": "2026-07-28T00:49:31.190Z", "date_only": false, "value": "2026-07-28T00:49:31.190324Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mro6uj4juo2f", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "67d35fc3-9033-44e7-91cc-45ad6a96ab82", "content": "CVE-2026-16812: Arista's Patch Is a Band-Aid for Systemic Oversight #CVE2026 #Arista #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mro6uj4juo2f"}, {"timestamp": "2026-07-28T01:20:57.134Z", "date_only": false, "value": "2026-07-28T01:20:57.134480Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mroand5mav2h", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "8f21f9c3-8f6b-49e0-8513-c29ac4be4711", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u60272\u4ef6\u3092\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 \n\nCISA Adds Two Known Exploited Vulnerabilities to Catalog  #CISA (Jul 27)\n\nCVE-2025-68686 Fortinet FortiOS\u306b\u304a\u3051\u308b\u6a5f\u5bc6\u60c5\u5831\u306e\u4e0d\u6b63\u30a2\u30af\u30bb\u30b9\u8106\u5f31\u6027\nCVE-2026-16812 Arista VeloCloud Orchestrator \u30aa\u30f3\u30d7\u30ec\u30df\u30b9 OS \u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mroand5mav2h"}, {"timestamp": "2026-07-28T01:38:06.114Z", "date_only": false, "value": "2026-07-28T01:38:06.114633Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mroblxvtbv2t", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "35c59419-aa79-4a07-839d-adfd3f2d65ae", "content": "(CISA TS-SOC) CVE-2026-16812 \u2013 Arista VeloCloud Orchestrator On-Prem OS Command Injection\u00a0Vulnerability\n\nSeverity: CRITICAL Impact Summary: Remote attackers may access privileged internal functionality and impact the VCO host, compromising the confidentiality, integrity, and availability of the\u2026", "url": "https://bsky.app/profile/thecybermind.co/post/3mroblxvtbv2t"}, {"timestamp": "2026-07-28T01:45:25.385Z", "date_only": false, "value": "2026-07-28T01:45:25.385632Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mrobz2wwqe2o", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "f8619b2e-82de-4271-9c5d-6285c58331a9", "content": "Arista patched CVE-2026-16812, a 10.0 unauthenticated OS command injection in on-prem VeloCloud Orchestrator, actively exploited and added to CISA's KEV catalog. #Arista #VeloCloud #CISA", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mrobz2wwqe2o"}, {"timestamp": "2026-07-28T03:56:40.567Z", "date_only": false, "value": "2026-07-28T03:56:40.567Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-16812", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-28T03:56:40.567Z", "date_only": false, "value": "2026-07-28T03:56:40.567Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-16812", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-28T05:44:56.215Z", "date_only": false, "value": "2026-07-28T05:44:56.215117Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mropfeaihq2w", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "1337d25c-c93d-4145-9db6-11ec6e654280", "content": "CVE-2026-16812 enables remote command injection in on-prem Arista VeloCloud Orchestrator, allowing privileged access and potential arbitrary code execution.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mropfeaihq2w"}, {"timestamp": "2026-07-28T06:05:55.831Z", "date_only": false, "value": "2026-07-28T06:05:55.831068Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mroqkvbifp2x", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "48958421-34de-4e27-ae98-f2cdc81497a0", "content": "A maximum-severity command injection flaw (CVE-2026-16812, CVSS 10.0) in on-premises Arista VeloCloud Orchestrator (VCO) is under active exploitation. CISA has [\u2026]", "url": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mroqkvbifp2x"}, {"timestamp": "2026-07-28T06:43:11.261Z", "date_only": false, "value": "2026-07-28T06:43:11.261926Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrosnj2min2p", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "c8c3bb58-7f84-4ef9-b4ec-e8ad0ab7e17e", "content": "CVE-2026-16812: Arista VeloCloud Orchestrator's Fatal Command Injection Flaw #CVE2026 #Cybersecurity #Vulnerability", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrosnj2min2p"}, {"timestamp": "2026-07-28T06:43:12.954Z", "date_only": false, "value": "2026-07-28T06:43:12.954040Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrosnktxtm2l", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "228dd3ac-77e8-4c5e-bc68-31da19e0a859", "content": "CVE-2026-16812: Attackers Exploit Arista VeloCloud Orchestrator Flaw #CVE2026 #CyberSecurity #InformationSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrosnktxtm2l"}, {"timestamp": "2026-07-28T06:43:14.530Z", "date_only": false, "value": "2026-07-28T06:43:14.530167Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrosnmmce62w", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "253d3425-ecae-46ca-9a8f-8f4afe137b7a", "content": "CVE-2026-16812: Arista VeloCloud's Command Injection Exposes Unseen Risks #CVE2026 #AristaVeloCloud #DataSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrosnmmce62w"}, {"timestamp": "2026-07-28T06:43:16.035Z", "date_only": false, "value": "2026-07-28T06:43:16.035994Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrosno4v2g2m", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "6504bf42-b892-4dfe-abda-3ccd7eba1f81", "content": "CVE-2026-16812 Reveals Critical Oversight in Arista's Security Practices #CyberSecurity #Vulnerability #CVE2026", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrosno4v2g2m"}, {"timestamp": "2026-07-28T06:43:19.538Z", "date_only": false, "value": "2026-07-28T06:43:19.538291Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrosnrgxl62w", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "db4348ad-a3b2-4f47-bd4f-0605febc7c6e", "content": "CVE-2026-16812: Arista VeloCloud's Command Injection Flaw Raises More Questions Than Answers #CVE2026 #AristaVeloCloud #Cybersecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrosnrgxl62w"}, {"timestamp": "2026-07-28T06:45:31.122Z", "date_only": false, "value": "2026-07-28T06:45:31.122606Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrosronirn2l", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "2b1b5a61-45e6-4324-939b-008e747abf36", "content": "CVE-2026-16812: Is Arista VeloCloud's Vulnerability a Policy Failing? #CyberSecurity #Vulnerability #CVE2026", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrosronirn2l"}, {"timestamp": "2026-07-28T06:52:19.257Z", "date_only": false, "value": "2026-07-28T06:52:19.257497Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mrot5twc7p2r", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "da0a7aa9-db8b-4c06-9dc4-7f145d694bc2", "content": "CVE-2026-16812 is a remotely exploitable VeloCloud Orchestrator OS injection flaw actively exploited in the wild, requiring only web access and no credentials.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mrot5twc7p2r"}, {"timestamp": "2026-07-28T07:00:44.107Z", "date_only": false, "value": "2026-07-28T07:00:44.107452Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/07/attackers-exploit-arista-velocloud.html", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "c3040444-2bcc-418c-a5fe-5f1839763f27", "content": "A maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in the wild.\n\nThe vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), is a case of operating system command injection that could pave the way for arbitrary code execution.\n\n\"VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue", "url": "https://thehackernews.com/2026/07/attackers-exploit-arista-velocloud.html"}, {"timestamp": "2026-07-28T08:48:48.942Z", "date_only": false, "value": "2026-07-28T08:48:48.942048Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mrozo5lz2n2w", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "8a0b6b07-7c69-4558-a871-8a5a2a590381", "content": "Arista VeloCloud Orchestrator on-premise\u7248\u306bOS\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027(CVE-2026-16812)\u304c\u3042\u308a\u3001\u60aa\u7528\u3055\u308c\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u53ef\u80fd\u6027\u3002\uff0895\u6587\u5b57\uff09", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mrozo5lz2n2w"}, {"timestamp": "2026-07-28T09:00:24.908Z", "date_only": false, "value": "2026-07-28T09:00:24.908932Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mrp2cvxmq52p", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "8cd8ad95-219c-4127-b055-28ea585bb1fd", "content": "Arista patched a critical zero-day OS injection flaw in VeloCloud Orchestrator On-Prem, tracked as CVE-2026-16812 with a CVSS 10 score. The flaw was exploited in the wild and requires no auth. #Arista #VeloCloud #CVE2026", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mrp2cvxmq52p"}, {"timestamp": "2026-07-28T09:38:55.081Z", "date_only": false, "value": "2026-07-28T09:38:55.081559Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrp4hqhpzm2m", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "f35cb247-7c10-48cb-b5ee-71cad218bd44", "content": "CVE-2026-16812: Arista's VeloCloud Bug Demands Immediate Action or Risk Breach #CVE2026 #VeloCloud #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrp4hqhpzm2m"}, {"timestamp": "2026-07-28T09:38:58.259Z", "date_only": false, "value": "2026-07-28T09:38:58.259970Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrp4hu274e2m", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "883efe2f-2a5e-4eeb-8e02-a5bf26305b18", "content": "CVE-2026-16812: Arista's VeloCloud Flaw Exposes Defenders to Active Attacks #CVE2026 #CyberSecurity #Vulnerability", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrp4hu274e2m"}, {"timestamp": "2026-07-28T09:39:02.063Z", "date_only": false, "value": "2026-07-28T09:39:02.063503Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrp4hxe22c2l", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "9d8b988a-9913-477f-bee7-9884dbfbe859", "content": "CVE-2026-16812: Arista's VeloCloud Bug Exposes Unmitigated Risks to Users #CVE2026 #Arista #VeloCloud", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrp4hxe22c2l"}, {"timestamp": "2026-07-28T09:39:05.065Z", "date_only": false, "value": "2026-07-28T09:39:05.065198Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrp4i2ecuj2o", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "97b93104-b3c3-4b60-9b57-41867021e4e0", "content": "CVE-2026-16812: Arista's VeloCloud Patch Raises More Questions About Oversight #CVE2026 #CyberSecurity #VeloCloud", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrp4i2ecuj2o"}, {"timestamp": "2026-07-28T09:39:07.957Z", "date_only": false, "value": "2026-07-28T09:39:07.957604Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrp4i57pwd2j", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "190518af-b4e9-4769-bf53-577bcf15bf49", "content": "CVE-2026-16812: Arista's Patch Raises Questions on Exploit Scope and Transparency #CVE2026 #AristaNetworks #VeloCloud", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrp4i57pwd2j"}, {"timestamp": "2026-07-28T09:39:11.958Z", "date_only": false, "value": "2026-07-28T09:39:11.958840Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrp4iawyac2y", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "0c1f2c9a-164e-47ad-a1e8-0a4cdc3175d8", "content": "CVE-2026-16812: Is Arista's VeloCloud Vulnerability Management Adequate? #CVE2026 #VeloCloud #AristaNetworks", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrp4iawyac2y"}, {"timestamp": "2026-07-28T09:40:52.763Z", "date_only": false, "value": "2026-07-28T09:40:52.763741Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mrp4lapa7423", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "e1a4eac7-cd34-49ff-bd35-e40d2ecc1ec8", "content": "A critical command injection vulnerability in Arista VeloCloud Orchestrator (CVE-2026-16812, CVSS 10.0) is actively exploited, allowing remote attackers to execute arbitrary code. Affected versions include VCO 5.2.x < 5.2.3.14, 6.1.x < 6.1.3.4, 6.4.x < 6.4.2.4, and 7.0.x < 7.0.0.1.", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mrp4lapa7423"}, {"timestamp": "2026-07-28T10:09:52.210Z", "date_only": false, "value": "2026-07-28T10:09:52.210086Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mrp673xov22s", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "0a3d4386-d4a8-4575-9d78-61948efd1e52", "content": "Every enterprise running Arista's $ANET on-prem VeloCloud Orchestrator faces a maximum-severity flaw under active attack. CVE-2026-16812 (CVSS 10.0) lets attackers inject commands and take over the orchestrator plus the branch Edge devices it manages. CISA: patch by July 30.", "url": "https://bsky.app/profile/shortinfo.bsky.social/post/3mrp673xov22s"}, {"timestamp": "2026-07-28T10:42:34.384Z", "date_only": false, "value": "2026-07-28T10:42:34.384037Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mrp7zklpv32v", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "7619d7f9-50ed-49d5-9a14-3adcb43a71aa", "content": "Arista's VeloCloud Orchestrator faces a critical zero-day vulnerability (CVE-2026-16812) under active exploitation. Immediate patching is essential. #Arista #VeloCloud thedailytechfeed.com/critical-zer...", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mrp7zklpv32v"}, {"timestamp": "2026-07-28T11:59:05.113Z", "date_only": false, "value": "2026-07-28T11:59:05.113165Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrpeceej5g23", "record": "cve-2026-16812", "field": "creation_timestamp", "uuid": "3f3c319e-da06-492b-918c-6afb73ec20a2", "content": "Your SD-WAN orchestrator just became an attacker's backdoor.\n\nVeloCloud Orchestrator on-prem.\n\nhttps://www.yazoul.net/advisory/cve/cve-2026-16812-vco-orchestator-unauth-access-exploited/\n\n#CVE #CyberSecurity", "url": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrpeceej5g23"}, {"timestamp": "2026-07-28T12:16:26.153Z", "date_only": false, "value": "2026-07-28T12:16:26.153068Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blindthoughts.bsky.social/post/3mrpfbgi23d2p", "record": "cve-2026-16812", "field": "creation_timestamp", "uuid": "a9dedc28-0695-4630-bf58-3904c8c0ea53", "content": "Patch Now: Arista VeloCloud Orchestrator Under Active Exploitation (CVSS 10.0)\n\nhttps://blindthoughts.com/arista-velocloud-orchestrator-cve-2026-16812-active-exploitation\n\n#vulnerability #sdwan #activeexploitation #networksecurity #patchmanagement", "url": "https://bsky.app/profile/blindthoughts.bsky.social/post/3mrpfbgi23d2p"}, {"timestamp": "2026-07-28T12:55:19.582Z", "date_only": false, "value": "2026-07-28T12:55:19.582654Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mrphgxne3t2o", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "582fe12e-6348-4e90-9d75-02adeffd5cc3", "content": "\ud83e\udd16 CVE-2026-16812 (CVSS 10.0): Critical unauthenticated OS command injection in Arista VeloCloud Orchestrator actively exploited. No auth required \u2014 full RCE. On-prem VCO targeted. Patch now.\nhttps://thehackernews.com/2026/07/attackers-exploit-arista-velocloud.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mrphgxne3t2o"}, {"timestamp": "2026-07-28T14:00:01.355Z", "date_only": false, "value": "2026-07-28T14:00:01.355177Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alphahunt.io/post/3mrpl2nc4va2n", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "a7a7f494-c928-4f5e-997c-2e6b02c5d476", "content": "Fresh exploitation signal\n\nCVE-2026-16812 is an unauthenticated VCO command injection. Arista says it is actively exploited and provides fixed releases.", "url": "https://bsky.app/profile/alphahunt.io/post/3mrpl2nc4va2n"}, {"timestamp": "2026-07-28T14:04:50.936Z", "date_only": false, "value": "2026-07-28T14:04:50.936961Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mrpldakrc42y", "record": "cve-2026-16812", "field": "creation_timestamp", "uuid": "66846c45-2ec6-4ba6-9fe4-e4a53fb69ef9", "content": "Arista VeloCloud Orchestrator CVE-2026-16812: CVSS 10.0 command injection, exploited in the wild.\n\nSD-WAN orchestrators reach every site you run. Patch now.\n\n#ThreatIntel #ICS\nhttps://threat-intelligence.redeyesecurity.com/blog/arista-velocloud-orchestrator-cve-2026-16812-exploited-2026", "url": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mrpldakrc42y"}, {"timestamp": "2026-07-28T17:22:18.043Z", "date_only": false, "value": "2026-07-28T17:22:18.043797Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/arista-networks-security-advisory-av26-751", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "775532ee-d6d9-49a4-aa48-8a819534d37c", "url": "https://cyber.gc.ca/en/alerts-advisories/arista-networks-security-advisory-av26-751"}, {"timestamp": "2026-07-28T21:00:05.118Z", "date_only": false, "value": "2026-07-28T21:00:05.118810Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8452", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "7e350bb7-347b-4981-aac9-714c5b4c05c5", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c \u0441 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0442\u0440\u0435\u043d\u0434\u043e\u0432\u044b\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0438 \u0443\u0433\u0440\u043e\u0437\u0430\u043c\u0438, \u043a\u043e\u0438\u0445 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043d\u043e\u0433\u043e. \u041f\u043e \u043f\u043e\u0440\u044f\u0434\u043a\u0443:\n\n1. STAR Labs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u044f\u0434\u0440\u0430 Linux, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 root-\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0431\u043e\u0440\u043a\u0435 CentOS Stream 9.\n\nCVE-2026-53264 (CVSS: 7.8), \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0433\u043e\u043d\u043a\u0438 \u0438\u0437-\u0437\u0430 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c \u044f\u0434\u0440\u0430. \u041d\u0430\u0439\u0442\u0438 \u043e\u0448\u0438\u0431\u043a\u0443 \u0438 \u0443\u0441\u043a\u043e\u0440\u0438\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043f\u043e\u043c\u043e\u0433 \u0418\u0418.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0435 \u0431\u044b\u043b\u043e \u0432\u043d\u0435\u0441\u0435\u043d\u043e 1 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u044b, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 Linux 4.14. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0440\u0435\u043b\u0438\u0437\u044b: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36 \u0438 7.0.13, \u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0435 \u0432\u043e\u0448\u043b\u043e \u0432 7.1-rc7.\n\n2. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Lava, \u0411\u043e\u043b\u0435\u0435 24 000 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0445 \u043a \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0443, \u0442\u0435\u0440\u044f\u044e\u0442 \u0445\u044d\u0448\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u0437-\u0437\u0430 CVE-2013-4786 (\u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0441\u043e\u0431\u043e\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 IPMI 2.0, \u043a\u043e\u0440\u0435\u043d\u044f\u0449\u0438\u0439\u0441\u044f \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435, \u0432\u0432\u0435\u0434\u0435\u043d\u043d\u043e\u043c \u0432 2004 \u0433\u043e\u0434\u0443) \u0432 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u043e\u0439 (BMC).\n\n3. Arista \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 CVE-2026-16812 \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f\u0445 VeloCloud Orchestrator, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430.\n\n4. Apple \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 87 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 iOS \u0438 155 \u0432 macOS Tahoe. \u0412 macOS Sequoia 15.7.8 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b 138 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0430 \u0432 macOS Sonoma 14.8.8 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 127 \u043f\u0440\u043e\u0431\u043b\u0435\u043c.\n\n\u041e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0435\u0442 CVE-2026-43810, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 Apple \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0432\u0440\u0435\u0434\u0438\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u044c \u044f\u0434\u0440\u0430, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043c\u0435\u043d\u044f\u0435\u0442 \u044d\u043a\u043e\u043d\u043e\u043c\u0438\u043a\u0443 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0430\u0442\u0430\u043a\n\n5. GitHub \u0438 PyPI \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 Dependabot \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043d\u0430 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u043f\u043e\u0441\u0442\u0430\u0432\u043e\u043a \u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0438\u0445 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0439.\n\n6. \u0412 n8n\u00a0\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (GHSA-gv7g-jm28-cr3m), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0443 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0443\u044e \u0441\u043e\u0431\u043e\u0439 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0433\u043b\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0443 \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u041e\u0421 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n\nSecurity Joes \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0437\u0443\u0447\u0430\u044f \u0444\u0435\u0432\u0440\u0430\u043b\u044c\u0441\u043a\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 n8n \u043d\u0430\u00a0\u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 CVE-2026-27577.\n\n7. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 macOS \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u0437\u0430\u043c\u0435\u043d\u044f\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0435\u0439, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430.\n\n\u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. \u041f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f. Apple \u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043d\u0435 \u0441\u043e\u0447\u043b\u0430 \u0435\u0451 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n8. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 XSS-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c ERPNext, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a. \u042d\u0442\u043e \u043e\u0434\u043d\u0430 \u0438\u0437 \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0438\u043c\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435.\n\n9. CVE-2026-9039 \u0432 \u0437\u0430\u0440\u044f\u0434\u043d\u044b\u0445 \u0441\u0442\u0430\u043d\u0446\u0438\u044f\u0445 XCharge EV \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0445\u0430\u043a\u0435\u0440\u0430\u043c \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Sailflow, \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0430\u0432\u0442\u043e\u043c\u043e\u0431\u0438\u043b\u044f \u043a \u0440\u0430\u0437\u044a\u0435\u043c\u0443 \u043d\u0430 \u0437\u0430\u0440\u044f\u0434\u043d\u043e\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 SSH-\u0441\u0435\u0440\u0432\u0438\u0441.\n\nSSH-\u0441\u0435\u0440\u0432\u0435\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u043f\u0430\u0440\u043e\u043b\u044c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e root/root. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0445 \u043f\u043e\u0434\u0437\u0430\u0440\u044f\u0434\u043e\u043a, \u043d\u0430\u043d\u0435\u0441\u0435\u043d\u0438\u044f \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u0449\u0435\u0440\u0431\u0430 \u0438\u043b\u0438 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u0432 \u0441\u0435\u0442\u044c \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430.\n\n10. CSRF-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0430\u0433\u0435\u043d\u0442\u0430\u0445 Workspace \u043e\u0442 OpenAI \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0446\u0435\u043b\u044b\u0439 (\u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439) \u0430\u0432\u0442\u043e\u043d\u043e\u043c\u043d\u044b\u0439 \u0430\u0433\u0435\u043d\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u0443\u0434\u0435\u0442 \u0436\u0438\u0442\u044c \u0432 \u0432\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u0445\u0438\u0449\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435.", "url": "https://t.me/true_secator/8452"}, {"timestamp": "2026-07-28T22:43:50.084Z", "date_only": false, "value": "2026-07-28T22:43:50.084891Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mrqidbu4ys2a", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "727f296f-d6e4-4f0e-b466-38f98a3bb77e", "content": "Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw\n\nA maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in the wild.\n\nThe vulnerability, tracked as CVE-2026-16812 (CVSS score:\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mrqidbu4ys2a"}, {"timestamp": "2026-07-29T01:00:04.289Z", "date_only": false, "value": "2026-07-29T01:00:04.289426Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/S_E_Reborn/6502", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "cef5f04f-4b6d-4a64-87ca-6e72d55e5098", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c \u0441 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0442\u0440\u0435\u043d\u0434\u043e\u0432\u044b\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0438 \u0443\u0433\u0440\u043e\u0437\u0430\u043c\u0438, \u043a\u043e\u0438\u0445 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043d\u043e\u0433\u043e. \u041f\u043e \u043f\u043e\u0440\u044f\u0434\u043a\u0443:\n\n1. STAR Labs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u044f\u0434\u0440\u0430 Linux, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 root-\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0431\u043e\u0440\u043a\u0435 CentOS Stream 9.\n\nCVE-2026-53264 (CVSS: 7.8), \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0433\u043e\u043d\u043a\u0438 \u0438\u0437-\u0437\u0430 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c \u044f\u0434\u0440\u0430. \u041d\u0430\u0439\u0442\u0438 \u043e\u0448\u0438\u0431\u043a\u0443 \u0438 \u0443\u0441\u043a\u043e\u0440\u0438\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043f\u043e\u043c\u043e\u0433 \u0418\u0418.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0435 \u0431\u044b\u043b\u043e \u0432\u043d\u0435\u0441\u0435\u043d\u043e 1 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u044b, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 Linux 4.14. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0440\u0435\u043b\u0438\u0437\u044b: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36 \u0438 7.0.13, \u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0435 \u0432\u043e\u0448\u043b\u043e \u0432 7.1-rc7.\n\n2. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Lava, \u0411\u043e\u043b\u0435\u0435 24 000 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0445 \u043a \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0443, \u0442\u0435\u0440\u044f\u044e\u0442 \u0445\u044d\u0448\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u0437-\u0437\u0430 CVE-2013-4786 (\u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0441\u043e\u0431\u043e\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 IPMI 2.0, \u043a\u043e\u0440\u0435\u043d\u044f\u0449\u0438\u0439\u0441\u044f \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435, \u0432\u0432\u0435\u0434\u0435\u043d\u043d\u043e\u043c \u0432 2004 \u0433\u043e\u0434\u0443) \u0432 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u043e\u0439 (BMC).\n\n3. Arista \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 CVE-2026-16812 \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f\u0445 VeloCloud Orchestrator, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430.\n\n4. Apple \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 87 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 iOS \u0438 155 \u0432 macOS Tahoe. \u0412 macOS Sequoia 15.7.8 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b 138 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0430 \u0432 macOS Sonoma 14.8.8 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 127 \u043f\u0440\u043e\u0431\u043b\u0435\u043c.\n\n\u041e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0435\u0442 CVE-2026-43810, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 Apple \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0432\u0440\u0435\u0434\u0438\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u044c \u044f\u0434\u0440\u0430, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043c\u0435\u043d\u044f\u0435\u0442 \u044d\u043a\u043e\u043d\u043e\u043c\u0438\u043a\u0443 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0430\u0442\u0430\u043a\n\n5. GitHub \u0438 PyPI \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 Dependabot \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a \u043d\u0430 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u043f\u043e\u0441\u0442\u0430\u0432\u043e\u043a \u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0438\u0445 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0439.\n\n6. \u0412 n8n\u00a0\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (GHSA-gv7g-jm28-cr3m), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0443 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0443\u044e \u0441\u043e\u0431\u043e\u0439 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0433\u043b\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0443 \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u041e\u0421 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n\nSecurity Joes \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0437\u0443\u0447\u0430\u044f \u0444\u0435\u0432\u0440\u0430\u043b\u044c\u0441\u043a\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 n8n \u043d\u0430\u00a0\u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 CVE-2026-27577.\n\n7. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 macOS \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u0437\u0430\u043c\u0435\u043d\u044f\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0435\u0439, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430.\n\n\u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. \u041f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f. Apple \u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043d\u0435 \u0441\u043e\u0447\u043b\u0430 \u0435\u0451 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n8. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 XSS-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c ERPNext, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a. \u042d\u0442\u043e \u043e\u0434\u043d\u0430 \u0438\u0437 \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0438\u043c\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435.\n\n9. CVE-2026-9039 \u0432 \u0437\u0430\u0440\u044f\u0434\u043d\u044b\u0445 \u0441\u0442\u0430\u043d\u0446\u0438\u044f\u0445 XCharge EV \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0445\u0430\u043a\u0435\u0440\u0430\u043c \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Sailflow, \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0430\u0432\u0442\u043e\u043c\u043e\u0431\u0438\u043b\u044f \u043a \u0440\u0430\u0437\u044a\u0435\u043c\u0443 \u043d\u0430 \u0437\u0430\u0440\u044f\u0434\u043d\u043e\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 SSH-\u0441\u0435\u0440\u0432\u0438\u0441.\n\nSSH-\u0441\u0435\u0440\u0432\u0435\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u043f\u0430\u0440\u043e\u043b\u044c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e root/root. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0445 \u043f\u043e\u0434\u0437\u0430\u0440\u044f\u0434\u043e\u043a, \u043d\u0430\u043d\u0435\u0441\u0435\u043d\u0438\u044f \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u0449\u0435\u0440\u0431\u0430 \u0438\u043b\u0438 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u0432 \u0441\u0435\u0442\u044c \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430.\n\n10. CSRF-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0430\u0433\u0435\u043d\u0442\u0430\u0445 Workspace \u043e\u0442 OpenAI \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0446\u0435\u043b\u044b\u0439 (\u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439) \u0430\u0432\u0442\u043e\u043d\u043e\u043c\u043d\u044b\u0439 \u0430\u0433\u0435\u043d\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u0443\u0434\u0435\u0442 \u0436\u0438\u0442\u044c \u0432 \u0432\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u0445\u0438\u0449\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435.", "url": "https://t.me/S_E_Reborn/6502"}, {"timestamp": "2026-07-29T02:07:06.983Z", "date_only": false, "value": "2026-07-29T02:07:06.983425Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrqtos5qoz26", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "969dd755-7b6a-47f5-8bd4-30f23fec20e1", "content": "\ud83d\udccc CVE-2026-16812 - VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and... https://www.cyberhub.blog/cves/CVE-2026-16812", "url": "https://bsky.app/profile/cyberhub.blog/post/3mrqtos5qoz26"}, {"timestamp": "2026-07-29T07:15:33.031Z", "date_only": false, "value": "2026-07-29T07:15:33.031343Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/calimegai.bsky.social/post/3mrrewciukx2h", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "b92c1c8b-1b49-4b20-aba6-6f2ade9ccc67", "content": "Une faille critique CVE-2026-16812 (score 10.0) dans #Arista #VeloCloud Orchestrator on-premise permet l\u2019ex\u00e9cution de code malveillant via injection de commandes OS. Exploit actif d\u00e9tect\u00e9. \ud83c\udf10 #CyberSecurity #Automatisation ", "url": "https://bsky.app/profile/calimegai.bsky.social/post/3mrrewciukx2h"}, {"timestamp": "2026-07-29T10:00:08.157Z", "date_only": false, "value": "2026-07-29T10:00:08.157258Z", "kind": "sighting", "label": "Seen", "source": "Telegram/cRQPi1vM_y23glpUKKDHcITfH9O0MaJ2YPlK6K5PUsotuA", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "36fcd44f-f74d-4c52-a5f8-e200085458e0"}, {"timestamp": "2026-07-29T12:02:35.224Z", "date_only": false, "value": "2026-07-29T12:02:35.224438Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrruxl2b472u", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "5d08d29e-e13c-460b-ad2e-1e538716db0a", "content": "Attackers aren't waiting for patches. They're exploiting what's already in your network.\n\nCVE-2026-16812.\n\nhttps://www.yazoul.net/news/article/attackers-exploit-arista-velocloud-orchestrator-command-injection-flaw/\n\n#InfoSec #ThreatIntel", "url": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrruxl2b472u"}, {"timestamp": "2026-07-29T15:00:03.893Z", "date_only": false, "value": "2026-07-29T15:00:03.893431Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/bdufstecru/3352", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "e3184f9f-7766-4d1e-9141-daed42de41ac", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u043e\u0440\u043a\u0435\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 VeloCloud Orchestrator (VCO) On-Prem \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0438\u0440\u0443\u0435\u043c\u044b\u043c\u0438 \u0441\u0435\u0442\u044f\u043c\u0438 VMware SD-WAN by VeloCloud \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438\n\nBDU:2026-10655\nCVE-2026-16812\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144", "url": "https://t.me/bdufstecru/3352"}, {"timestamp": "2026-07-29T17:17:30.358Z", "date_only": false, "value": "2026-07-29T17:17:30.358851Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrsgkpdc7t2w", "record": "cve-2026-16812", "field": "creation_timestamp", "uuid": "30120a0d-d493-442a-8d05-eba7e013c754", "content": "A perfect CVSS 10.0 on your network orchestrator. What could go wrong?\n\nVeloCloud Orchestrator on-premises.\nCVSS 10.0.\n\nhttps://www.yazoul.net/advisory/cve/cve-2026-16812-vco-orchestator-unauth-access-exploited/\n\n#CyberSecurity #PatchNow", "url": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrsgkpdc7t2w"}, {"timestamp": "2026-07-30T00:00:00Z", "date_only": true, "value": "2026-07-30", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-16812", "field": "evidence.0.details.due_date", "uuid": "7c882d21-a5e5-4284-a2a2-e3af479640a0", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-30T00:02:06.077Z", "date_only": false, "value": "2026-07-30T00:02:06.077030Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/cRQPi1vM_y23glpUKKDHcITfH9O0MaJ2YPlK6K5PUsotuA", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "a9711202-35e5-49f8-b7b2-4aeed30abb2a", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-30T02:16:22.432Z", "date_only": false, "value": "2026-07-30T02:16:22.432744Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mrteobipoj2p", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "6839a0d2-7165-448a-a3fc-6b1a244cbb39", "content": "Arista addresses CVE-2026-16812, a critical vulnerability in VeloCloud Orchestrator actively exploited to gain unauthenticated remote code execution.\n\n#Arista #VeloCloud #Cybersecurity #CVE202616812 #RCE", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mrteobipoj2p"}, {"timestamp": "2026-07-30T08:00:10.239Z", "date_only": false, "value": "2026-07-30T08:00:10.239659Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mrtxuzdics2s", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "a2bb4fe3-c3db-4c2e-a341-fd19110e9ea9", "content": "Arista VeloCloud Orchestrator CVE-2026-16812 (CVSS 10.0): unauthenticated command injection, actively exploited. Single controller = entire SD-WAN compromised. CISA deadline 07/30. Patch to 5.2.3.14/6.1.3.4/6.4.2.4/7.0.0.1 now.\n\nzurl.co/67hF8\u00a0 \nzurl.co/useVQ\n\n#CyberSecurity #CISA #SDWAN #Arista", "url": "https://bsky.app/profile/diesec.bsky.social/post/3mrtxuzdics2s"}, {"timestamp": "2026-07-30T17:36:41.877Z", "date_only": false, "value": "2026-07-30T17:36:41.877590Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mruy3wsgfy2g", "record": "cve-2026-16812", "field": "creation_timestamp", "uuid": "d8cd84cb-d70a-48cd-8447-89dcad544e80", "content": "\ud83d\udea8 One command injection. Full host compromise. Your SD-WAN is now their pivot point.\n\nVeloCloud Orchestrator on-prem.\n\nhttps://www.yazoul.net/advisory/cve/cve-2026-16812-vco-orchestator-unauth-access-exploited/\n\n#InfoSec #DataBreach", "url": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mruy3wsgfy2g"}, {"timestamp": "2026-07-30T17:52:12.230Z", "date_only": false, "value": "2026-07-30T17:52:12.230562Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mruyxnnopv2j", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "336a582d-4263-4b9d-b673-0698ce95d2e8", "content": "\ud83d\udea8 CRITICAL: A CVSS 10.0 zero-day (CVE-2026-16812) in Arista's on-prem VeloCloud Orchestrator is actively exploited. Unauthenticated RCE allows full SD-WAN compromise. CISA mandates immediate patching. #CVE202616812 #ZeroDay #SDWAN\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mruyxnnopv2j"}, {"timestamp": "2026-07-31T09:46:12.551Z", "date_only": false, "value": "2026-07-31T09:46:12.551019Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrwobkjto42n", "record": "cve-2026-16812", "field": "creation_timestamp", "uuid": "ef5e865e-bad4-4632-ad53-52175c33e02f", "content": "\ud83d\udea8 CVSS 10.0 is not a typo. This is as critical as it gets.\n\nCVE-2026-16812.\n\nhttps://www.yazoul.net/advisory/cve/cve-2026-16812-vco-orchestator-unauth-access-exploited/\n\n#CyberSecurity #PatchNow", "url": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrwobkjto42n"}, {"timestamp": "2026-07-31T12:01:38.808Z", "date_only": false, "value": "2026-07-31T12:01:38.808898Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrwvtqpcuk2w", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "f4d75ba0-80d1-4caa-84dd-cc1fa5a5fb70", "content": "This is no longer a theoretical flaw. It's being exploited right now.\n\nCVE-2026-16812.\n\nhttps://www.yazoul.net/news/article/attackers-exploit-arista-velocloud-orchestrator-command-injection-flaw/\n\n#InfoSec #DataBreach", "url": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrwvtqpcuk2w"}, {"timestamp": "2026-08-01T09:07:14.246Z", "date_only": false, "value": "2026-08-01T09:07:14.246776Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrz4kscbue2b", "record": "cve-2026-16812", "field": "creation_timestamp", "uuid": "79c14185-b6b7-4d66-a234-0d871c02555a", "content": "\ud83d\udea8 A perfect CVSS 10.0 score is rare. This one deserves it.\n\nhttps://www.yazoul.net/advisory/cve/cve-2026-16812-vco-orchestator-unauth-access-exploited/\n\n#InfoSec #DataBreach", "url": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrz4kscbue2b"}, {"timestamp": "2026-08-02T15:29:54.522Z", "date_only": false, "value": "2026-08-02T15:29:54.522697Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3ms4cfxyovr2h", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "42c71f80-d558-4c28-8a8c-2a3644901857", "content": "Active threat: CVE-2026-16812 (CVSS 10.0) affecting on-prem Arista VeloCloud Orchestrator. It's a severe OS command injection flaw leading to potential code execution. Stay alert!", "url": "https://bsky.app/profile/technoholic.bsky.social/post/3ms4cfxyovr2h"}, {"timestamp": "2026-08-03T14:42:34.129Z", "date_only": false, "value": "2026-08-03T14:42:34.129984Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3ms6qaabq4b2t", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "45e0d6e3-0563-4b43-8ac5-0b2c65747886", "content": "Critical VeloCloud Orchestrator vulnerability (CVE-2026-16812) exploited; immediate patching required. #VeloCloud #CVE202616812 #SDWAN #CyberSecurity #NetworkSecurity #Arista thedailytechfeed.com/critical-vel...", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3ms6qaabq4b2t"}, {"timestamp": "2026-08-03T15:01:17.021Z", "date_only": false, "value": "2026-08-03T15:01:17.021667Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3ms6rbp3y4s2f", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "407e9f46-dc6b-48c6-ade9-9a7709fb09cb", "content": "Kritieke kwetsbaarheid in VeloCloud Orchestrator wordt actief misbruikt\n\nOnderzoekers hebben een ernstige beveiligingskwetsbaarheid ontdekt in on-premises VeloCloud Orchestrator (VCO) implementaties, met het registratienummer CVE-2026-16812, die momenteel actief wordt uitgebuit. De ...", "url": "https://bsky.app/profile/newsfacts.bsky.social/post/3ms6rbp3y4s2f"}, {"timestamp": "2026-08-04T01:43:15.967Z", "date_only": false, "value": "2026-08-04T01:43:15.967918Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threadlinqs.bsky.social/post/3ms7v5nglkn2g", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "4e4ed6a4-d6ad-4407-b939-b9312a889b3d", "content": "CVE-2026-16812: CVSS 10.0 pre-auth RCE in Arista VCO - actively exploited, patch now. https://intel.threadlinqs.com/threat/TL-2026-1851 #ThreatIntel #CVE_2026_16812 #BUG1901675 #Arista", "url": "https://bsky.app/profile/threadlinqs.bsky.social/post/3ms7v5nglkn2g"}, {"timestamp": "2026-08-11T09:13:09.897Z", "date_only": false, "value": "2026-08-11T09:13:09.897543Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0281", "record": "NCSC-2026-0281", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-08-11T09:13:09.897Z", "date_only": false, "value": "2026-08-11T09:13:09.897543Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0281", "record": "NCSC-2026-0281", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-11T09:13:09.897Z", "date_only": false, "value": "2026-08-11T09:13:09.897543Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0281", "record": "NCSC-2026-0281", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-08-21T23:00:07.659Z", "date_only": false, "value": "2026-08-21T23:00:07.659046Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pphm_HackerNews/2344", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "cb6b19aa-78b3-4174-a631-6fec455dfe1c", "content": "\ud83d\udd34 Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw\n\nA maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in the wild.\n\nThe vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), is a case of operating system command injection that could pave the way for arbitrary code execution.\n\n\"VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host,\" Arista\u00a0said\u00a0in a Monday advisory.", "url": "https://t.me/pphm_HackerNews/2344"}, {"timestamp": "2026-08-23T00:00:45.352Z", "date_only": false, "value": "2026-08-23T00:00:45.352196Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/pphm_HackerNews/2344", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "f88330d4-1d6c-4593-aa6c-0b702c4977af", "content": "\ud83d\udd34 Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw\n\nA maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in the wild.\n\nThe vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), is a case of operating system command injection that could pave the way for arbitrary code execution.\n\n\"VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host,\" Arista\u00a0said\u00a0in a Monday advisory.", "url": "https://t.me/pphm_HackerNews/2344", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-26T03:48:44.148Z", "date_only": false, "value": "2026-08-26T03:48:44.148382Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtxggbv4hs2y", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "ea960db5-8c84-4289-ba12-09c5b3b96862", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\nRelease Date July 27, 2026\n\nCVE-2025-68686 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability\nCVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtxggbv4hs2y"}, {"timestamp": "2026-08-26T04:03:24.809Z", "date_only": false, "value": "2026-08-26T04:03:24.809407Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtxhajovfs2y", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "5c608238-6cdc-496e-9a32-ba287fd47467", "content": "\u7c73\u5f53\u5c40\u3001\u300cFortiOS\u300d\u300cVeloCloud Orchestrator\u300d\u306e\u8106\u5f31\u6027\u60aa\u7528\u3092\u78ba\u8a8d\n\n\u7c73\u5f53\u5c40\u306f\u3001\u300cFortiOS\u300d\u3084\u300cVeloCloud Orchestrator\u300d\u306b\u5224\u660e\u3057\u305f2\u4ef6\u306e\u8106\u5f31\u6027\u304c\u3001\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3068\u3057\u3066\u6ce8\u610f\u3092\u547c\u3073\u304b\u3051\u305f\u3002\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u73fe\u5730\u6642\u95932026\u5e747\u670827\u65e5\u3001\u300c\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\uff08KEV\uff09\u300d\u30782\u4ef6\u306e\u8106\u5f31\u6027\u300cCVE-2026-16812\u300d\u300cCVE-2025-68686\u300d\u3092\u8ffd\u52a0\u3057\u305f\u3002\n\n\u300cCVE-2026-16812\u300d\u306f\u3001SD-WAN\u74b0\u5883\u306e\u7d71\u5408\u7ba1\u7406\u88fd\u54c1\u300cArista VeloCloud...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtxhajovfs2y"}, {"timestamp": "2026-08-26T04:06:01.057Z", "date_only": false, "value": "2026-08-26T04:06:01.057765Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtxhf65jw22y", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "3880743d-b9b4-41e1-9d78-c30a788ac9a4", "content": "\u300cVeloCloud Orchestrator\u300d\u306b\u8106\u5f31\u6027\u3001\u60aa\u7528\u3092\u78ba\u8a8d - \u4fb5\u5bb3\u8abf\u67fb\u3092\n\nSD-WAN\u74b0\u5883\u306e\u7d71\u5408\u7ba1\u7406\u88fd\u54c1\u300cArista VeloCloud Orchestrator\uff08VCO\uff09\u300d\u306e\u30aa\u30f3\u30d7\u30ec\u30df\u30b9\u7248\u306b\u6df1\u523b\u306a\u8106\u5f31\u6027\u304c\u660e\u3089\u304b\u3068\u306a\u3063\u305f\u3002\u3059\u3067\u306b\u8106\u5f31\u6027\u306e\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u308b\u3002\n\nArista Networks\u306f\u73fe\u5730\u6642\u95937\u670827\u65e5\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea\u3092\u516c\u958b\u3057\u3001OS\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u300cCVE-2026-16812\u300d\u3092\u660e\u3089\u304b\u306b\u3057\u305f\u3002\u3059\u3067\u306b\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u308b\u3068\u3044\u3046\u3002\n\n\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u7d4c\u7531\u3067\u30a6\u30a7\u30d6\u30a4\u30f3\u30bf\u30d5\u30a7\u30fc\u30b9\u3078\u30a2\u30af\u30bb\u30b9\u3067\u304d\u308c\u3070\u3001\u300cVCO\u300d\u306e\u30c6\u30ca\u30f3\u30c8\u3084\u30aa\u30da\u30ec\u30fc\u30bf\u306e\u8a8d\u8a3c\u60c5\u5831\u306f\u5fc5\u8981\u306a...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtxhf65jw22y"}, {"timestamp": "2026-08-26T04:52:35.493Z", "date_only": false, "value": "2026-08-26T04:52:35.493413Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtxjyerxvs2y", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "74b4c42e-09f1-4bff-ad4e-7dfcfb3b1028", "content": "\u653b\u6483\u8005\u304cArista VeloCloud Orchestrator\u306e\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\n\nArista VeloCloud Orchestrator\uff08VCO\uff09\u306e\u30aa\u30f3\u30d7\u30ec\u30df\u30b9\u7248\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u3001\u6700\u3082\u6df1\u523b\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u6b20\u9665\u304c\u3001\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u304c\u660e\u3089\u304b\u306b\u306a\u3063\u305f\u3002\n\nCVE-2026-16812\uff08CVSS\u30b9\u30b3\u30a2\uff1a10.0\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u3053\u306e\u8106\u5f31\u6027\u306f\u3001\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0\u30b7\u30b9\u30c6\u30e0\u306e\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u4e8b\u4f8b\u3067\u3042\u308a\u3001\u4efb\u610f\u306e\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\n\n\u300c\u30aa\u30f3\u30d7\u30ec\u30df\u30b9\u7248VeloCloud Orchestrator\uff08VCO\uff09\u306b\u306f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u554f\u984c\u304c\u3042\u308a\u3001\u3053\u306e...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtxjyerxvs2y"}, {"timestamp": "2026-08-27T11:59:21.467Z", "date_only": false, "value": "2026-08-27T11:59:21.467372Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mu2scilfqy2t", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "ec14a181-c1a2-407b-af51-7806d7daf18f", "content": "Top 3 CVE for last 7 days:\nCVE-2026-69836: 43 interactions\nCVE-2026-73570: 22 interactions\nCVE-2026-19490: 15 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-65641: 8 interactions\nCVE-2026-16812: 5 interactions\nCVE-2026-19632: 5 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mu2scilfqy2t"}, {"timestamp": "2026-09-18T08:00:05.791Z", "date_only": false, "value": "2026-09-18T08:00:05.791805Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/43681", "record": "CVE-2026-16812", "field": "creation_timestamp", "uuid": "c6642cb1-f2be-4ebf-97a8-3857ed215ff7", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\n\nCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2025-68686 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability\nCVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog", "url": "https://t.me/VulnerabilityNews/43681", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-24T13:10:00.147Z", "date_only": false, "value": "2026-10-24T13:10:00.147", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-16812", "record": "FKIE_CVE-2026-16812", "field": "lastModified"}], "metrics": {"as_of": "2026-10-29T11:19:18.754Z", "anchors": {"origin": {"timestamp": "2026-07-27T16:07:00Z", "date_only": false, "value": "2026-07-27T16:07:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / Arista", "record": "CVE-2026-16812", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-07-27T16:07:00Z", "date_only": false, "value": "2026-07-27T16:07:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / Arista", "record": "CVE-2026-16812", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": {"timestamp": "2026-07-27T00:00:00Z", "date_only": false, "value": "2026-07-27T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-16812", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "7c882d21-a5e5-4284-a2a2-e3af479640a0", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": -58020.0, "hours": -16.116666666666667, "days": -0.6715277777777777, "min_seconds": -58020.0, "max_seconds": 28380.0, "approximate": true, "ongoing": false, "order_known": false, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-27T16:07:00Z", "date_only": false, "value": "2026-07-27T16:07:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / Arista", "record": "CVE-2026-16812", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-27T00:00:00Z", "date_only": false, "value": "2026-07-27T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-16812", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "7c882d21-a5e5-4284-a2a2-e3af479640a0", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": -58020.0, "hours": -16.116666666666667, "days": -0.6715277777777777, "min_seconds": -58020.0, "max_seconds": 28380.0, "approximate": true, "ongoing": false, "order_known": false, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-27T16:07:00Z", "date_only": false, "value": "2026-07-27T16:07:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / Arista", "record": "CVE-2026-16812", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-27T00:00:00Z", "date_only": false, "value": "2026-07-27T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-16812", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "7c882d21-a5e5-4284-a2a2-e3af479640a0", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 8104338.754133, "hours": 2251.205209481389, "days": 93.80021706172454, "min_seconds": 8104338.754133, "max_seconds": 8104338.754133, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-27T16:07:00Z", "date_only": false, "value": "2026-07-27T16:07:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / Arista", "record": "CVE-2026-16812", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T11:19:18.754Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 8162358.754133, "hours": 2267.3218761480557, "days": 94.47174483950232, "min_seconds": 8075958.754133, "max_seconds": 8162358.754133, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-27T00:00:00Z", "date_only": false, "value": "2026-07-27T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-16812", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "7c882d21-a5e5-4284-a2a2-e3af479640a0", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-10-29T11:19:18.754Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}