Threat Intelligence Brief — July 28, 2026: Arista VeloCloud Zero-Day Exploited, TeamCity RCE, AI-Assisted Linux Exploit

Published: July 28, 2026 | Author: Gerald Tuhneag | Threat Intelligence Lab

Executive Summary

Today’s threat landscape features a CVSS 10.0 command injection flaw in Arista VeloCloud Orchestrator under active exploitation, a critical JetBrains TeamCity vulnerability enabling unauthenticated RCE, and a Linux kernel privilege escalation exploit developed with AI assistance. CISA has added both the Arista flaw and a Fortinet SSL-VPN vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agency patching within days. Additionally, new APT activity targeting Middle East governments abuses Telegram for command-and-control, and a phishing campaign codenamed Operation BlueDash deploys legitimate RMM tools through fake Microsoft Teams update pages. For context on how these vulnerabilities fit into the broader threat ecosystem, see our analysis of supply chain attacks in 2026 and our guide on how actionable threat intelligence drives incident response.

Critical Vulnerabilities

CVE-2026-16812 — Arista VeloCloud Orchestrator Command Injection (CVSS 10.0) ⚠️ Active Exploitation

A maximum-severity OS command injection vulnerability in on-premises versions of Arista VeloCloud Orchestrator (VCO) has been confirmed under active exploitation. The flaw allows a remote, unauthenticated attacker to access privileged internal functionality and execute arbitrary operating system commands on the VCO host, potentially compromising the confidentiality, integrity, and availability of the orchestrator and all managed devices.

Affected Versions:

• VCO 5.2.x prior to 5.2.3.14
• VCO 6.1.x prior to 6.1.3.4
• VCO 6.4.x prior to 6.4.2.4
• VCO 7.0.x prior to 7.0.0.1

Indicators of Compromise (IoCs):

• 8.19.75.217
• 206.72.242.124
• 206.72.242.162

MITRE ATT&CK Mapping: Initial Access (T1190 – Exploit Public-Facing Application), Execution (T1059 – Command and Scripting Interpreter), Persistence (T1505.003 – Server Software Component: Web Shell). A successful compromise of the VCO may grant attackers access to managed VeloCloud Edge devices, necessitating credential rotation and validation of device state across the entire SD-WAN fabric.

CISA Action: Added to KEV catalog July 27, 2026. FCEB agencies must patch by July 30, 2026. All organizations running on-prem VCO should treat this as an emergency-patch scenario.

“If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible.”

— Arista Security Advisory 0144

CVE-2026-63077 — JetBrains TeamCity Unauthenticated RCE (CVSS 9.8)

JetBrains has disclosed a critical authentication bypass in on-premises TeamCity servers that enables unauthenticated attackers with HTTP(S) access to bypass authentication checks and execute arbitrary OS commands. The vulnerability exploits the agent polling protocol to sidestep authentication. TeamCity Cloud instances have already been patched. Researcher Antoni Tremblay is credited with discovery (July 10, 2026).

Fixed in: TeamCity On-Premises 2025.11.7 and 2026.1.3. All prior versions are affected. Given TeamCity’s role in CI/CD pipelines, a compromise could cascade into supply chain attacks through poisoned build artifacts — an attack vector we have analyzed extensively in our supply chain threat coverage.

CVE-2026-53264 — Linux Traffic-Control Use-After-Free to Root (CVSS 7.8) + AI-Assisted Exploit

STAR Labs published a local privilege escalation exploit targeting CentOS Stream 9 that leverages a use-after-free race condition in the kernel’s network traffic-control subsystem. Researcher Lee Jia Jie stated that artificial intelligence assisted in both finding the bug and accelerating exploit development — a notable milestone in AI-augmented vulnerability research. The upstream fix landed June 1, 2026, with backports to stable kernel branches.

Exploitation requires a local foothold, unprivileged user namespaces, and specific kernel configuration options (CONFIG_NET_ACT_GACT, CONFIG_NET_CLS_FLOWER), limiting immediate exposure. However, full exploit source code is public, making weaponization trivial for attackers with initial access.

CISA KEV Updates This Week

• CVE-2026-16812 (Arista VCO) — CVSS 10.0 — Due: July 30, 2026
• CVE-2025-68686 (Fortinet FortiOS SSL-VPN) — CVSS 5.3 — Due: August 10, 2026. Information disclosure allowing bypass of prior symbolic link persistency patch.

Threat Actor Activity

TELESHIM — East Asian APT Targets Middle East Governments via Telegram C2

Zscaler ThreatLabz identified a campaign by an East Asia-linked threat actor deploying three new malware families — TELESHIM, MIXEDKEY, and BINDCLOAK — against government entities in the Middle East. TELESHIM, a 32-bit Windows backdoor, abuses the Telegram API for command-and-control communication, blending malicious traffic with legitimate Telegram network activity. The multi-stage infection chain begins with an ISO file containing a legitimate executable used for DLL sideloading.

MITRE ATT&CK: T1574.002 (DLL Side-Loading), T1102.002 (Web Service: Bidirectional Communication — Telegram API), T1204.002 (User Execution: Malicious File). Defenders should monitor for unexpected Telegram API connections from non-browser processes and inspect ISO-mounted execution chains.

Operation BlueDash — Fake Teams Update Delivers Level RMM and ScreenConnect

ZeroBEC researchers uncovered a phishing campaign using “secure document” lures themed around Microsoft Teams. Victims are directed through compromised infrastructure to a counterfeit Microsoft Store page (teamvem[.]com) that claims Teams must be updated before a shared document can be viewed. The fake update delivers supportdev.exe, an Inno Setup loader that deploys legitimate Level RMM and ConnectWise ScreenConnect installers using attacker-controlled enrollment keys, establishing persistent remote access.

Key IOCs: Domain teamvem[.]com, enrollment key LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D. Organizations should block this domain, hunt for unauthorized RMM tool installations, and educate users that Microsoft Teams updates are delivered through the application itself, never through external download pages.

Other Notable Developments

• GitHub Dependabot 3-Day Cooldown: GitHub introduced a default 3-day waiting period before Dependabot opens version-update pull requests, reducing the risk of automatically pulling poisoned package versions. Security updates remain immediate. This is a meaningful defense-in-depth improvement for software supply chain security.
• Dysphoria IoT Botnet: Adopted blockchain-based C2 and victim-device relays post-JackSkid disruption, with estimated 200,000+ bots. Defenders should patch exposed IoT devices and eliminate default credentials.
• Microsoft MAI-Cyber-1-Flash: Microsoft launched its first cybersecurity-specific AI model, scoring 95.95% on CyberGym within the MDASH vulnerability identification platform.
• NVIDIA Open Secure AI Alliance: A 37-member consortium (Microsoft, Cisco, CrowdStrike, IBM, Palo Alto Networks, and others) formed to develop open security technologies for AI agents, open-sourcing the NOOA framework under Apache 2.0.

Recommended Actions for Defenders

1. Patch Arista VCO immediately — CVSS 10.0 with active exploitation and CISA KEV listing. If patching is delayed, restrict VCO web interface access to trusted admin networks and monitor for the published IoCs.
2. Upgrade JetBrains TeamCity to 2025.11.7 or 2026.1.3. Review build logs for signs of unauthorized access, especially in CI/CD pipelines with production deployment access.
3. Apply Linux kernel updates addressing CVE-2026-53264. Restrict unprivileged user namespaces where feasible.
4. Block IoCs associated with the Arista VCO exploitation and Operation BlueDash infrastructure.
5. Hunt for unauthorized RMM tools (Level, ScreenConnect, AnyDesk, etc.) using application inventory and EDR telemetry.
6. Monitor Telegram API connections from non-standard processes as a potential indicator of TELESHIM-like C2.
7. Review Fortinet FortiOS SSL-VPN patches for CVE-2025-68686 and apply before August 10 if still unpatched.

---

Sources: The Hacker News, Arista Security Advisory 0144, CISA KEV Catalog, Zscaler ThreatLabz, ZeroBEC, Proofpoint, JetBrains, STAR Labs. This brief is prepared by Threat Intelligence Lab to provide actionable intelligence for security operations teams and decision-makers. All IoCs should be verified in your environment before taking blocking actions. For more on integrating threat intelligence into your security operations, read our guide on how actionable threat intelligence helps in incident response.

Infographic: Threat Intelligence Brief — July 28, 2026

Infographic: July 28 Threat Brief at a Glance

Download and share this infographic with your security team. It summarizes all critical CVEs, IoCs, MITRE ATT&CK mappings, threat actor activity, and priority defender actions from today’s brief.