CISA added eight new vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog during the past seven days, spanning enterprise network orchestrators (Arista VeloCloud Orchestrator), security gateways (Check Point SmartConsole), firewalls & SD-WAN (Fortinet FortiOS), collaboration platforms (Microsoft SharePoint), web publishing platforms (WordPress Core), AI application frameworks (Langflow), and consumer/SOHO networking firmware (DD-WRT). The most significant operational trend is the active exploit chaining targeting web core architectures alongside perimeter authentication bypasses and deserialization vectors. Security, vulnerability management, and infrastructure teams should prioritize internet-facing management consoles, content management instances, and collaboration servers for immediate validation and remediation activity.

Reading time 10 minutes

Audience: Vulnerability Managers, Security Operations, CISOs, DevSecOps Teams
Reading Time: Approximately 10 minutes

This Week's KEV Additions

Analysis

CVE-2026-16812 - Arista VeloCloud Orchestrator On-Prem

What it is → An OS command injection vulnerability in Arista VeloCloud Orchestrator On-Prem allowing a remote attacker to execute arbitrary system commands.

Affected versions → Arista VeloCloud Orchestrator On-Prem versions prior to security hotfix release.

Exploitation status Active exploitation confirmed via CISA KEV inclusion.

Patch available Yes. Security advisories and updates released by Arista.

Operational risk Unauthenticated remote attackers can execute OS-level commands, achieving full compromise of the orchestration host and network control plane.

CVE-2025-68686 - Fortinet FortiOS

What it is → An exposure of sensitive information flaw (CWE-200) resulting from an improper patch bypass for a symbolic link persistency mechanism.

Affected versions → Fortinet FortiOS 7.6.0 through 7.6.2 and affected earlier release trains.

Exploitation status Active exploitation confirmed via CISA KEV inclusion.

Patch available Yes. Addressed in Fortinet security advisories.

Operational risk Allows remote unauthenticated attackers to bypass security boundaries, disclose system information, or facilitate persistent administrative access following initial compromise.

CVE-2026-50522 - Microsoft SharePoint Server

What it is → An unauthenticated deserialization of untrusted data flaw (CWE-502) in Microsoft SharePoint enabling remote code execution.

Affected versions → Supported on-premises Microsoft SharePoint Server editions (2016, 2019, Subscription Edition).

Exploitation status Active exploitation confirmed; elevated EPSS score reflects significant scanning and deployment by threat groups.

Patch available Yes. Patched in Microsoft Security Update Guide (July release).

Operational risk Allows remote unauthenticated attackers to execute arbitrary code within the SharePoint service context, enabling domain lateral movement.

CVE-2026-16232 - Check Point SmartConsole

What it is → An improper authentication flaw (CWE-287) in Check Point Quantum & Multi-Domain Security Management SmartConsole Login.

Affected versions → Check Point Quantum Security Management / Multi-Domain Security Management up to R81.10.

Exploitation status Active zero-day exploitation confirmed in the wild.

Patch available Yes. Hotfixes published via Check Point Support Center.

Operational risk Allows an unauthenticated remote attacker to obtain administrative login tokens, take over perimeter management consoles, and manipulate gateway security policies.

CVE-2026-63030 - WordPress Core

What it is → An interpretation conflict vulnerability (CWE-436) in the WordPress Core REST API batch endpoint (/wp-json/batch/v1).

Affected versions → WordPress Core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1.

Exploitation status Active zero-day exploitation confirmed in wild exploit chains ("wp2shell").

Patch available Yes. Addressed in WordPress Core maintenance releases (6.9.5 and 7.0.2).

Operational risk Combines with SQL injection flaws to allow unauthenticated remote attackers to execute arbitrary code and fully compromise web hosting infrastructure.

CVE-2026-60137 - WordPress Core

What it is → An improper input sanitization flaw in WP_Query (author__not_in parameter) leading to SQL injection.

Affected versions → WordPress Core versions 6.8.0 through 6.8.5, 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1.

Exploitation status Active exploitation confirmed when chained with CVE-2026-63030.

Patch available Yes. Patched in WordPress Core security updates.

Operational risk Facilitates database data extraction and unauthenticated remote code execution when triggered via batch REST endpoints.

CVE-2026-0770 - Langflow

What it is → An inclusion of functionality from untrusted control sphere vulnerability (CWE-829) in the exec_globals parameter of the validate endpoint.

Affected versions → Langflow versions up to and including 1.7.3.

Exploitation status Active exploitation confirmed via CISA KEV inclusion.

Patch available Yes. Fixed in updated Langflow releases.

Operational risk Unauthenticated remote attackers can issue crafted validation requests to execute arbitrary Python code with root privileges.

CVE-2021-27137 - DD-WRT

What it is → A stack-based buffer overflow flaw (CWE-121) in router/upnp/src/ssdp.c due to unsafe strcpy handling in UPnP SSDP M-SEARCH requests.

Affected versions → DD-WRT builds prior to 45724.

Exploitation status Active exploitation by IoT botnet campaigns (e.g., c0xmo botnet).

Patch available Yes. Addressed in DD-WRT changeset 45724 and later.

Operational risk Remote unauthenticated attackers on exposed UPnP interfaces can trigger buffer overflows to achieve remote code execution and botnet recruitment.

Exploitation Context

This week's KEV additions reflect aggressive threat actor focus on enterprise management planes (Arista VeloCloud Orchestrator, Check Point SmartConsole), productivity collaboration engines (Microsoft SharePoint), and AI workflow platforms (Langflow).

Attackers are increasingly leveraging sophisticated exploit chaining—demonstrated by the WordPress Core "wp2shell" chain combining API interpretation conflicts with query sanitization flaws—to achieve unauthenticated RCE without credential requirements. The inclusion of legacy router vulnerabilities (DD-WRT) highlights persistent botnet recruitment scanning targeting unpatched perimeter infrastructure.

Remediation Priorities

Detection and Monitoring Guidance

Hackerstorm Analysis

This week's KEV updates highlight that threat actors continue to prioritize high-value management consoles and web backend infrastructure as primary vectors for rapid organizational access. By targeting platforms like Check Point SmartConsole and Arista VeloCloud Orchestrator, adversaries bypass standard endpoint controls to compromise entire network management layers directly.

Additionally, the rapid real-world weaponization of API logic flaws and exploit chains in widely used software like WordPress and SharePoint underscores that vulnerability managers cannot rely solely on individual vulnerability severity scores. KEV inclusion confirms active adversary adoption, requiring security teams to deploy immediate patching and telemetry monitoring across edge appliances and identity-adjacent productivity tools.

Further Reading

🔗 Exposure-Based Vulnerability Prioritization: EPSS, KEV & Risk
Why read this: Integrate EPSS scoring with KEV intelligence for exposure-driven remediation decisions.
https://www.hackerstorm.com/articles/our-blog/vulnerability-intelligence-analysis/vulnerability-management-operational-risk-exposure-prioritization

🔗 CVE Overload: Why Most Patch Programs Fail
Why read this: Identify systemic vulnerabilities in traditional patching workflows.
https://www.hackerstorm.com/articles/our-blog/vulnerabililty-intelligence/why-most-patch-programs-fail

🔗 CVSS vs EPSS: How to Prioritise Vulnerabilities by Real Exploitation Risk
Why read this: Replace static severity scoring with probability-based threat modeling.
https://www.hackerstorm.com/articles/our-blog/vulnerability-intelligence-analysis/cvss-vs-epss-vulnerability-prioritisation-exploitation-risk

About This Report

Attribution Note

This analysis is based on publicly available reporting and security research summaries. Some technical details may change as additional information becomes available. 

Author Information

Timur Mehmet | Founder & Lead Editor

Timur is a veteran Information Security professional with a career spanning over three decades. Since the 1990s, he has led security initiatives across high-stakes sectors, including Finance, Telecommunications, Media, and Energy. Professional qualifications over the years have included CISSP, ISO27000 Auditor, ITIL and technologies such as Networking, Operating Systems, PKI, Firewalls. For more information including independent citations and credentials, visit our About page.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Standards

This article adheres to Hackerstorm.com's commitment to accuracy, independence, and transparency:

• Fact-Checking: All statistics and claims are verified against primary sources and authoritative reports
• Source Transparency: Original research sources and citations are provided in the References section below
• No Conflicts of Interest: This analysis is independent and not sponsored by any vendor or organization
• Corrections Policy: We correct errors promptly and transparently. Report inaccuracies to This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Policy: Ethics, Non-Bias, Fact Checking and Corrections

Learn More: About Hackerstorm.com | FAQs

Source Transparency

CISA Known Exploited Vulnerabilities (KEV) Catalog Primary source used to verify KEV additions, inclusion dates, exploitation status, and Federal Civilian Executive Branch (FCEB) remediation deadlines.

Microsoft Security Response Center (MSRC) Advisory — CVE-2026-50522 Used to validate affected SharePoint versions, exploitation conditions, and security update releases.

Check Point Support Advisory — CVE-2026-16232 Used to confirm affected SmartConsole versions, authentication bypass mechanics, and hotfix availability. WordPress Core Security Release Guidance — CVE-2026-63030 / CVE-2026-60137 Used to validate REST API batch routing conflicts, SQL injection vectors, and core update requirements.

Arista Security Advisories — CVE-2026-16812 Used to validate VeloCloud Orchestrator OS command injection details and remediation guidance.

Fortinet Security Advisories — CVE-2025-68686 Used to confirm FortiOS symlink exposure details and affected release trains.

FIRST Exploit Prediction Scoring System (EPSS) Database Used to provide exploitation probability metrics supporting threat-informed patch prioritization.

Hackerstorm CVE Intelligence Portal Used for internal CVE enrichment, analyst workflow integration, vulnerability correlation, and report linking.

Analyst Notes

• No ransomware attribution was publicly associated with this week's KEV additions at the time of publication.
• No confirmed threat actor attribution was available beyond CISA's confirmation of active exploitation for the majority of entries.
• Where vendor advisory details or EPSS values were unavailable at publication time, placeholders were retained pending analyst validation and vendor updates prior to final publication.