Three critical vulnerabilities demand attention this morning. A CVSS 10.0 zero-day in Arista’s VeloCloud Orchestrator is actively exploited, a Fastjson Java library RCE has no available patch, and JetBrains TeamCity has an unauthenticated command execution flaw that puts CI/CD pipelines at risk. Meanwhile, Talos data confirms that phishing now accounts for more than half of all incident response engagements — a sharp quarter-over-quarter increase driven by techniques designed to bypass traditional email gateways.

In the News

Arista VeloCloud Orchestrator Zero-Day Exploited in the Wild — CVE-2026-16812

CVE-2026-16812 is an OS command injection vulnerability in on-premises Arista VeloCloud Orchestrator (VCO) deployments, rated CVSS 10.0 — the maximum possible severity. The flaw exists in privileged internal functionality and requires no authentication to exploit. An attacker with network access to the VCO management interface can execute arbitrary operating system commands with full privileges on the underlying host.

Active exploitation has been confirmed. Because VCO is the central management plane for VeloCloud SD-WAN deployments, a compromised orchestrator gives the attacker visibility into and control over every branch-office edge device managed by that instance. The blast radius of a single exploited VCO is the entire SD-WAN fabric it controls.

Arista has released a patch. Organizations running on-premises VCO must update immediately. For environments where immediate patching is not possible, the compensating control is to isolate the VCO management interface from all internet-facing and general-purpose network segments — restrict access to an out-of-band management network with explicit allow-lists. This is not a vulnerability that can wait for a maintenance window.

What defenders should do: Patch on-prem VeloCloud Orchestrator immediately. If patching is not possible within hours, isolate VCO management interfaces to dedicated out-of-band networks. Audit VCO access logs for any evidence of unauthorized command execution during the exposure window.

Source: SecurityWeek

Fastjson Zero-Day RCE Hits US Enterprises — No Patch Available

A critical remote code execution vulnerability in the Fastjson Java serialization library is being actively exploited against US enterprises. The flaw is exploitable under default configurations without authentication, which means any Java-based web application or API that uses Fastjson for JSON deserialization is a potential target. No vendor patch exists at the time of writing.

Fastjson is widely used across enterprise Java stacks, often as a transitive dependency pulled in by other libraries. Many organizations will not know they are running it without a current software bill of materials (SBOM). This is a recurring pattern in library-level vulnerabilities — the attack surface is invisible to teams that lack software composition analysis tooling.

Without a patch, the immediate mitigations are network segmentation around application tiers running Java workloads, web application firewall rules to detect and block known exploitation payloads, and runtime application self-protection (RASP) if deployed. The longer-term takeaway is familiar: organizations that cannot answer “where is this library in our stack?” within minutes of a zero-day disclosure are operating blind.

What defenders should do: Inventory all Java applications for Fastjson dependencies using SCA or SBOM tooling. Segment vulnerable application tiers. Deploy WAF virtual-patching rules for known Fastjson exploitation patterns. Monitor for anomalous outbound connections from Java application servers.

Source: BleepingComputer

JetBrains TeamCity Critical Flaw — CVE-2026-63077

CVE-2026-63077 (CVSS 9.8) affects all on-premises versions of JetBrains TeamCity and allows unauthenticated OS command execution on the build server. No credentials, no prior access, no user interaction required. An attacker who can reach the TeamCity web interface over the network can execute arbitrary commands on the host operating system.

CI/CD pipeline compromise is one of the most consequential initial access vectors in modern software supply chains (MITRE ATT&CK: T1195.002 — Supply Chain Compromise: Compromise Software Supply Chain). A compromised build server can inject malicious code into every artifact the pipeline produces — binaries, container images, deployment packages. The downstream impact extends to every environment that receives those artifacts.

JetBrains has released a patch. On-premises TeamCity customers must update manually; cloud-hosted instances are not affected. Beyond patching, build servers should be microsegmented so they are not reachable from general user networks or the public internet. Application allowlisting on build infrastructure limits what an attacker can execute even after gaining access.

What defenders should do: Update on-prem TeamCity immediately. Restrict network access to build servers to known repository and artifact endpoints only. Implement application allowlisting on CI/CD infrastructure. Monitor build server network traffic for anomalous outbound connections.

Source: The Hacker News

Talos Reports Phishing Drives 50%+ of IR Engagements in Q2 2026

Cisco Talos’s Q2 2026 incident response trends report reveals that phishing accounted for more than half of all IR engagements during the quarter, a significant increase from approximately one-third in Q1. The dominant techniques are QR codes embedded in PDF attachments and credential-harvesting links hosted on legitimate cloud services — both designed to bypass traditional secure email gateways that inspect inline URLs and known-malicious attachments.

The technique evolution is deliberate. QR codes render as images, not as scannable URLs, so gateway-level link inspection does not flag them. Cloud-hosted harvesting pages sit behind trusted domains (SharePoint, Google Docs, Dropbox), which many gateways allow-list by default. The result is that the initial delivery mechanism evades the control most organizations consider their primary phishing defense.

The countermeasures are layered. Click-time URL analysis through an inline cloud proxy (SSE or SASE architecture) inspects the destination when the user actually clicks, not when the email is delivered. Phishing-resistant MFA — specifically FIDO2 — ensures that even successful credential harvesting does not give the attacker a usable session. Neither control alone is sufficient; together, they address both the delivery bypass and the credential theft objective.

What defenders should do: Deploy click-time URL inspection via SSE/SASE inline proxy. Enforce phishing-resistant MFA (FIDO2) for all externally-facing and privileged accounts. Train SOC analysts to hunt for QR-code phishing indicators in email telemetry.

Source: Cisco Talos Blog

Today’s Deep Dive — Autonomous AI Agents Cross the Operational Threshold

The Record reports the first confirmed use of an autonomous AI agent in a live espionage operation: an open-source Hermes model was deployed against Thailand’s Finance Ministry by an unattributed threat actor. This crosses a line that the security community has anticipated but had not yet observed in a confirmed incident — an AI agent operating autonomously during an intrusion, making decisions about lateral movement and data collection without real-time human direction.

The operational significance is distinct from AI-assisted vulnerability research (which we have already seen with CVE-2026-53264, the Linux kernel traffic-control flaw where AI-assisted exploit development was publicly documented). In the Thailand case, the AI agent was not a research tool — it was the hands-on-keyboard operator. It conducted reconnaissance, selected targets, and exfiltrated data within the compromised network (MITRE ATT&CK: T1071 — Application Layer Protocol, T1560 — Archive Collected Data).

For defenders, the detection challenge is subtle. AI-driven lateral movement may exhibit more consistent timing, fewer typographical errors in commands, and more systematic enumeration patterns than human operators. Paradoxically, this regularity could become a detection signal — behavioral analytics tuned to flag unusually methodical internal reconnaissance may catch AI operators more reliably than human ones. Network detection tools that baseline normal east-west traffic patterns and alert on systematic port scanning or credential spraying remain the primary detection layer.

The Dysphoria IoT botnet, which reached 200,000 infected devices this month and adopted blockchain-based C2 to resist takedown, represents the other side of the AI-threat convergence: automated propagation at scale with resilient command infrastructure. IoT and OT segmentation — isolating vulnerable devices into network zones with strict egress controls — is the primary mitigation for environments with unpatched IoT devices that cannot run endpoint agents.

Source: The Record, BleepingComputer

Defender Action Items

  • Patch Arista VeloCloud Orchestrator for CVE-2026-16812 immediately; if patching is delayed, isolate VCO management interfaces to out-of-band networks with explicit allow-lists
  • Inventory Java applications for Fastjson using SCA or SBOM tooling; segment vulnerable tiers and deploy WAF virtual-patching rules
  • Update on-prem JetBrains TeamCity for CVE-2026-63077; microsegment build servers and restrict their network access to repository and artifact endpoints only
  • Deploy click-time URL inspection (SSE/SASE inline proxy) and enforce FIDO2-based phishing-resistant MFA to counter the QR-code and cloud-hosted phishing techniques driving 50%+ of current IR engagements
  • Segment IoT and OT devices into dedicated network zones with strict egress controls to limit Dysphoria botnet propagation risk
  • Review Linux kernel patch status for CVE-2026-53264 (traffic-control subsystem local privilege escalation, CVSS 7.8) in Linux-heavy environments

Detection Queries

The following Splunk SPL query identifies potential VeloCloud Orchestrator command injection attempts by monitoring web server access logs for OS command injection patterns in request URIs targeting VCO management endpoints. Tune the index and sourcetype to match your environment.

index=web sourcetype=access_combined
  (uri_path="*/velocloud/*" OR uri_path="*/vco/*" OR uri_path="*/portal/rest/*")
  (uri_query="*%3B*" OR uri_query="*%7C*" OR uri_query="*%60*" OR uri_query="*;*" OR uri_query="*|*" OR uri_query="*`*")
| stats count by src_ip, uri_path, uri_query, status
| where count > 3
| sort -count

This query looks for semicolons, pipes, and backticks (URL-encoded and raw) in query strings targeting VeloCloud Orchestrator URI paths — common OS command injection delimiters. A threshold of 3+ requests from the same source reduces false positives from legitimate traffic. Correlate hits with VCO host-level process execution logs for confirmation.

References

Subscribe to the it-learn Brief

Get the daily cybersecurity brief in your inbox every weekday morning — news, SE angles, and detection queries.