CISA KEV - DIESEC

Arista VeloCloud Orchestrator CVE-2026-16812 Exploited

By Editorial Team | July 30, 2026

Arista VeloCloud Orchestrator CVE-2026-16812 (CVSS 10.0) is under active attack. Unauthenticated command injection lets attackers seize full SD-WAN control.

Arista VeloCloud Orchestrator CVE-2026-16812 is a maximum-severity, unauthenticated command injection flaw under active exploitation right now, and it hands an attacker control of an entire SD-WAN fabric from a single unpatched management console. CISA added it to the Known Exploited Vulnerabilities catalog on July 27, with a federal patch deadline of July 30. If your…

Check Point SmartConsole CVE-2026-16232: Admin Bypass

By Editorial Team | July 27, 2026

Check Point SmartConsole CVE-2026-16232 is now on CISA’s Known Exploited Vulnerabilities list: an unauthenticated attacker can forge a login token and get full administrator access to the console that manages an organization’s entire firewall fleet. Check Point patched it on July 22 and confirmed a handful of customers were already targeted. The federal remediation deadline…

wp2shell WordPress RCE: Patch Now

By Editorial Team | July 24, 2026

wp2shell WordPress RCE is now a two-CVE chain in CISA’s Known Exploited Vulnerabilities catalog — and it lets a completely unauthenticated attacker execute code on a default WordPress install with no plugins involved. If you run self-hosted WordPress and haven’t confirmed the July 17 auto-update landed, check today. What Happened wp2shell WordPress RCE combines two…