Forwarded from TWCERTCC Cybersecurity Alert TWCERTCC-200-202608-00000001

【CVE-2025-68686】Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVSS v3.1: 5.9)
【Whether exploited by ransomware: Unknown】Fortinet FortiOS contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability, which may allow an unauthorized remote attacker to bypass patches developed for a symbolic link persistence mechanism observed in certain post-exploitation cases through specially crafted HTTP requests. An attacker must first successfully compromise the product through other vulnerabilities at the file system level before this vulnerability can be exploited.

【CVE-2026-16812】Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability (CVSS v3.1: 10.0)
【Whether exploited by ransomware: Unknown】Arista VeloCloud Orchestrator On-Prem contains an operating system command injection vulnerability, which may allow a remote attacker to access internal privileged functions and impact the VCO host. Successful exploitation of this vulnerability may compromise the confidentiality, integrity, and availability of the Orchestrator and the data it manages.

【CVE-2026-20316】Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability (CVSS v3.1: 5.3)
【Whether exploited by ransomware: Unknown】Cisco Secure Firewall Management Center contains a Use of Hard-coded Password vulnerability, which may allow an unauthenticated remote attacker to log in to an affected device using a low-privilege account and access sensitive data within the affected system.