Cyber Threat Brief — July 28 2026
⚠️ This report is AI-generated. Always validate findings.
1. Arista VeloCloud Orchestrator Unauth RCE — CVE-2026-16812
TL;DR: CVSS 10.0 unauthenticated OS command injection in on-premises VeloCloud Orchestrator is under active exploitation and was added to CISA KEV July 27 with a July 30 federal deadline. Compromised VCO pivots to all managed SD-WAN edge devices.
What’s New:
- CISA KEV addition July 27; FCEB deadline July 30 (Wednesday)
- Unauth command injection via internal-only functionality left remotely accessible (CWE-78)
- No credentials, no user interaction required; network access to VCO web interface is sufficient
- Arista has not disclosed attribution, exploitation timeline, or IOCs
- Hosted and Dedicated VCO deployments were pre-patched; only on-prem is affected
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| VCO web interface (on-prem) | Attack surface | T1190 | Firewall logs | Restrict access to management VLAN |
| VCO < 5.2.3.14 / 6.1.3.4 / 6.4.2.4 | Vulnerable versions | T1190 | Asset inventory | Patch immediately |
| Anomalous OS commands from VCO process | Post-exploitation | T1059 | EDR / auditd | Hunt |
| VeloCloud Edge config changes | Lateral movement | T1021 | SD-WAN controller logs | Audit |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No VeloCloud-specific detection; need web server spawning shell rule tuned for VCO |
| Elastic | None | No coverage |
| Sigma | None | No coverage; need rule for anomalous process execution on VCO host |
Sources: BleepingComputer, The Hacker News, CISA KEV July 27, Arista SA-0144
2. JetBrains TeamCity Pre-Auth Deserialization RCE — CVE-2026-63077
TL;DR: CVSS 9.8 unauthenticated RCE in all TeamCity On-Premises versions via insecure deserialization in the agent polling protocol; patches dropped July 27 — expect rapid weaponization given TeamCity’s exploitation history.
What’s New:
- Disclosed and patched July 27; affects all TeamCity On-Premises versions
- Insecure deserialization of untrusted data (CWE-502) in agent polling protocol
- Unauthenticated attacker with HTTP(S) access bypasses auth and executes OS commands
- Fixed in 2025.11.7 and 2026.1.3; security patch plugin for 2017.1+
- TeamCity Cloud not affected; privately reported July 10 by Antoni Tremblay
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| TeamCity agent polling endpoint | Attack surface | T1190 | WAF/proxy logs | Monitor for anomalous serialized payloads |
| TeamCity < 2025.11.7 / 2026.1.3 | Vulnerable versions | T1190 | Asset inventory | Patch or apply plugin immediately |
| Unexpected child processes from TeamCity service | Post-exploitation | T1059 | EDR / Sysmon | Hunt |
| Outbound connections from TeamCity server | C2 indicator | T1071 | Firewall/proxy logs | Baseline and alert |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No TeamCity-specific detection; need Java process spawning shell rule tuned for TeamCity service |
| Elastic | Web Shell Detection: Script Process Child of Common Web Processes (partial) | Not tuned for TeamCity agent protocol |
| Sigma | Suspicious Java Process Spawning Shell (generic) | Needs TeamCity process name tuning |
Sources: JetBrains Blog, The Hacker News
3. Certighost AD CS PoC Updated — CVE-2026-54121
TL;DR: The public Certighost PoC received July 28 updates that fix reliability issues against CAs co-hosted on DCs — expect broader exploitation of this CVSS 8.8 AD CS domain takeover flaw now that the tooling works out-of-the-box.
What’s New:
- PoC updated July 28: in-script hotpatch of rogue SMB NetLogon path ensures exploit works when CA is on a DC
- Fix for request-supplied SANs avoids KDC_ERR_CLIENT_NAME_MISMATCH errors
- SOCPrime released detection content for Certighost abuse; Sigma TargetImage logic triggers EID 5154/5156
- Microsoft Defender generates “Potential Certighost (CVE-2026-54121) AD CS abuse” alert
- Patched July 14 Patch Tuesday; exploitation requires low-priv domain account + network access
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
Certificate request with cdc attribute | Exploitation | T1649 | AD CS audit logs (EID 4886/4887) | Alert on non-standard attributes |
| Rogue LDAP listener on port 389 from non-DC host | Exploitation | T1557 | Network flow / firewall | Block/Alert |
| DCSync (EID 4662 with DS-Replication-Get-Changes) | Post-exploitation | T1003.006 | Windows Security log | Alert |
certighost.py process or SMB listener | PoC tool | T1649 | EDR / Sysmon | Hunt |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | DCSync Activity (EID 4662) | Misses certificate-based pre-DCSync path; need CA enrollment anomaly rule |
| Elastic | Active Directory Certificate Services Abuse | Partial — detects DCSync stage only |
| Sigma | win_security_dcsync_attack.yml | Covers DCSync but not cert issuance with cdc attribute anomaly |
Sources: Help Net Security, SOCPrime, GitHub PoC
4. FortiOS Symlink Persistence Bypass — CVE-2025-68686
TL;DR: CISA KEV addition July 27 for a FortiOS information disclosure that lets attackers bypass a previous symlink persistence fix — requires prior filesystem access via a separate vulnerability but enables read-only access to sensitive data on patched appliances.
What’s New:
- CISA KEV addition July 27 alongside CVE-2026-16812
- Bypasses previously patched symbolic link persistency mechanism via crafted HTTP requests
- Affects FortiOS 7.6.0-7.6.1, 7.4.0-7.4.6, all 7.2.x/7.0.x/6.4.x
- Requires prior filesystem-level access (not standalone exploitable)
- Chained with initial access vulns for persistent read access post-patch
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Symbolic links in FortiOS filesystem | Persistence | T1547 | FortiOS system integrity check | Run Fortinet integrity verification tool |
| FortiOS < 7.6.2 / 7.4.7 | Vulnerable versions | T1190 | Asset inventory | Patch or verify no prior compromise |
| Anomalous HTTP requests to management plane | Exploitation | T1190 | FortiOS traffic logs | Hunt |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None specific | Need FortiOS integrity violation detection |
| Elastic | None | No coverage |
| Sigma | None | No coverage; need rule for FortiOS symlink persistence indicators |
Sources: Security Affairs, CISA KEV July 27
Status Updates
- CVE-2026-56155 (AD FS EoP): Federal CISA KEV deadline TODAY July 28. Zero-day exploitation ongoing. Patch via July 14 Patch Tuesday. Original brief.
- CVE-2026-12569 (PTC Windchill/FlexPLM): Cl0p extortion campaign ongoing via
support@cryptohox[.]com. JSP webshells andflst.txtrecon active. Original brief. - CVE-2026-6875 (ServiceNow): Active exploitation ongoing since July 18. Two sandbox-escape gadget chains confirmed. Fortune 500 victims. Still not on CISA KEV. Original brief.
- CVE-2026-50522 (SharePoint Deserialization): Federal deadline passed July 25. Active exploitation via BinaryFormatter at
/_trust/default.aspx. Machine key theft for persistence. Original brief. - CVE-2026-16232 (Check Point SmartConsole): Federal deadline passed July 25. Zero-day auth bypass exploitation ongoing. Original brief.