Act now:Arista VeloCloud Orchestrator: Two Exploited CVSS 10 Flaws. Anyone running VeloCloud Orchestrator On-Prem (formerly VeloCloud Orchestrator by Broadcom) on the 5.2, 6.1, 6.4 or 7.0 trains, most urgently where the web interface is internet-reachable or Edge certificate authentication is enabled.
Act now:Gitea CVE-2026-60004: Exploited RCE via diffpatch API. Every self-hosted Gitea instance from 1.17 through 1.27.0, most urgently internet-facing ones with open self-registration; Forgejo admins should confirm they are on 15.0.9 / 16.0.5 or later.
Do you run any of these? Arista VeloCloud Orchestrator, Fortinet FortiOS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-07-30.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
On-prem VCO operators should move to 5.2.3.16 or 6.4.2.8 now, lock the web interface down and hunt for the published backdoor files; both flaws are exploited, and the July fixes do not cover the September bug.
Must act: Anyone running VeloCloud Orchestrator On-Prem (formerly VeloCloud Orchestrator by Broadcom) on the 5.2, 6.1, 6.4 or 7.0 trains, most urgently where the web interface is internet-reachable or Edge certificate authentication is enabled.
Can relax: Customers on Arista Hosted or Dedicated VCO, which Arista patched itself; VeloCloud Edges and Gateways are listed as not affected.
Inventory every on-prem VCO and its exact release; anything at or below 5.2.3.15, 6.1.3.7, 6.4.2.7 or 7.0.0.2 is exposed to at least one exploited flaw.
Upgrade to 5.2.3.16 or 6.4.2.8 or later; on 6.1, 7.0 or an unsupported train, contact Arista TAC for an upgrade path.
Restrict the VCO web interface to trusted administrative networks and block outbound ports the VCO host does not need.
Upgrade every self-hosted Gitea below 1.27.1 today and close open registration; automated attacks sign up, create a repo and get a shell in seconds, and a proof of concept is public.
Must act: Every self-hosted Gitea instance from 1.17 through 1.27.0, most urgently internet-facing ones with open self-registration; Forgejo admins should confirm they are on 15.0.9 / 16.0.5 or later.
Can relax: Instances already on Gitea 1.27.1, 1.27.3 or the renumbered 28.x line, provided nothing was planted before the upgrade.
Check the version (gitea --version or GET /api/v1/version) and upgrade to 1.27.1 or later; current releases are 1.27.3 and 28.2.0.
Set DISABLE_REGISTRATION = true in app.ini (or require email confirmation and CAPTCHA) unless public sign-up is essential.
Review accounts created recently and their repositories; remove anything you do not recognize.
Any self-hosted TeamCity server below 2025.11.7 or 2026.1.3 that an attacker can reach over HTTP(S) can be taken over without credentials, and ransomware crews are using it; patch or apply the security patch plugin today, then check for intrusions.
Must act: Everyone running TeamCity On-Premises older than 2025.11.7 or 2026.1.3 without JetBrains' security patch plugin, above all internet-facing servers.
Can relax: TeamCity Cloud customers, whom JetBrains says need no action, and on-prem servers already on 2025.11.7, 2026.1.3 or later, or with the patch plugin installed.
Upgrade TeamCity On-Premises to 2025.11.7 or 2026.1.3 (or later), or install the CVE-2026-63077 security patch plugin.
If you cannot patch right away, cut off external access to the server.
Search server logs for com.thoughtworks.xstream.converters.ConversionException and investigate any hits.