---
title: "Security digest: July 27, 2026"
url: https://erroneo.us/security/2026-07-27/
description: "July 27, 2026 vulnerability digest: 3 briefs (Arista VeloCloud Orchestrator: Two Exploited…); 2 CISA KEV additions (Arista, Fortinet). What to patch and who…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-07-27
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 27, 2026

3 editorial briefs and 2 known exploited (cisa kev) additions.

## Take stock

- Act now: Arista VeloCloud Orchestrator: Two Exploited CVSS 10 Flaws . Anyone running VeloCloud Orchestrator On-Prem (formerly VeloCloud Orchestrator by Broadcom) on the 5.2, 6.1, 6.4 or 7.0 trains, most urgently where the web interface is internet-reachable or Edge certificate authentication is enabled.
- Act now: Gitea CVE-2026-60004: Exploited RCE via diffpatch API . Every self-hosted Gitea instance from 1.17 through 1.27.0, most urgently internet-facing ones with open self-registration; Forgejo admins should confirm they are on 15.0.9 / 16.0.5 or later.
- Act now: TeamCity CVE-2026-63077: Unauthenticated RCE, Exploited . Everyone running TeamCity On-Premises older than 2025.11.7 or 2026.1.3 without JetBrains' security patch plugin, above all internet-facing servers.
- Do you run any of these? Arista VeloCloud Orchestrator, Fortinet FortiOS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-07-30.
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [Arista VeloCloud Orchestrator: Two Exploited CVSS 10 Flaws](https://erroneo.us/security/briefs/arista-velocloud-orchestrator-cve-2026-16812-93952-exploited-rce/index.md): On-prem VCO operators should move to 5.2.3.16 or 6.4.2.8 now, lock the web interface down and hunt for the published backdoor files; both flaws are exploited, and the July fixes do not cover the September bug.
- **Act now** [Gitea CVE-2026-60004: Exploited RCE via diffpatch API](https://erroneo.us/security/briefs/gitea-cve-2026-60004-diffpatch-git-hook-rce/index.md): Upgrade every self-hosted Gitea below 1.27.1 today and close open registration; automated attacks sign up, create a repo and get a shell in seconds, and a proof of concept is public.
- **Act now** [TeamCity CVE-2026-63077: Unauthenticated RCE, Exploited](https://erroneo.us/security/briefs/teamcity-cve-2026-63077-unauthenticated-rce/index.md): Any self-hosted TeamCity server below 2025.11.7 or 2026.1.3 that an attacker can reach over HTTP(S) can be taken over without credentials, and ransomware crews are using it; patch or apply the security patch plugin today, then check for intrusions.

## Known exploited (CISA KEV)

- [CVE-2026-16812](https://erroneo.us/security/cve/CVE-2026-16812/index.md) Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability (CISA due 2026-07-30)
- [CVE-2025-68686](https://erroneo.us/security/cve/CVE-2025-68686/index.md) Fortinet FortiOS: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CISA due 2026-08-10)

## Critical advisories

None.

---
Source page: https://erroneo.us/security/2026-07-27/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt