The exploited surface this week was the management plane itself — VeloCloud Orchestrator, Secure FMC, Check Point SmartConsole, FortiOS SSL-VPN and exposed BMCs, and on several of them what the attacker obtained outlives the upgrade

If you did nothing this week: the boxes you use to manage everything else are the ones that were being exploited, and on the FortiOS and BMC surfaces in particular, upgrading now does not undo what was already read — a symlink planted before the patch survives it, and a password hash captured from an exposed controller stays crackable offline afterwards.

Five unrelated disclosures landed on the same architectural layer. Arista disclosed CVE-2026-16812 on 2026-07-27, an unauthenticated OS command-injection flaw in on-prem VeloCloud Orchestrator carrying CVSS 10.0, and stated plainly that "this issue was discovered externally and is known to be actively exploited" (Arista Networks, 2026-07-27); CISA added it to the Known Exploited Vulnerabilities catalog the same day (CISA, 2026-07-27). Cisco disclosed CVE-2026-20316 on 2026-07-29, a vendor-embedded static password for a low-privileged account in the Secure Firewall Management Center web interface, recording that "in July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability" and raising the advisory's Security Impact Rating above what the 5.3 base score implies because "this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges" (Cisco PSIRT, 2026-07-29). Rapid7 published the root cause of the already-exploited Check Point management bypass CVE-2026-16232 on 2026-07-28, finding that the vulnerable method preferred a caller-supplied Secure Internal Communication distinguished name over the one bound to the authenticated peer certificate — and that "exploitation requires network access to the Management Server and for a Trusted Clients configuration that does not restrict GUI clients, which in our testing was a default setting" (Rapid7 Labs, 2026-07-28).

The other two strands are about defeating remediation rather than obtaining access. CISA KEV-listed FortiOS CVE-2025-68686 on 2026-07-27 (CISA, 2026-07-27), a flaw whose entire function is to bypass the patch Fortinet built for the symbolic-link persistence technique seen in earlier FortiGate post-exploitation; Fortinet is explicit that it is not an initial-access vector, because "this vulnerability can only be abused as a consequence of a threat actor exploiting a known vulnerability to implement read-only access to vulnerable FortiGate devices, at file system level" (Fortinet PSIRT, 2026-02-10). That precondition is what makes it consequential for this constituency rather than academic: any FortiGate that was exposed to an earlier root-filesystem flaw and then declared remediated may still be readable. And Lava's internet scan put a number on the oldest management-plane exposure of the set, reporting that "approximately two-thirds of the exposed BMCs we tested returned at least one password-derived authentication hash before client authentication was complete" (Lava, 2026-07-29) — a 2004-era design property of the IPMI RAKP handshake with no vendor patch on offer. That it is being used, not merely exposed, is the finding: Lava records that "during our research, we found an exposed HPE iLO 4 login page displaying a ransom note in its Security Notice panel" (Lava, 2026-07-29), and Lava's CTO expanded on that to Dark Reading, describing compromised systems at one of the world's largest automotive component manufacturers with servers displaying the same notes — the same researcher speaking again rather than an independent confirmation (Dark Reading, 2026-07-28).

What ties these together operationally is that a management plane is a lateral-movement primitive by design, so compromising one converts directly into authority over everything it administers. Arista states the consequence for its own product without hedging: "compromises to the VCO platform may allow attackers access to the VeloCloud Edge devices as well" (Arista Networks, 2026-07-27). The same logic runs through the others — a Secure FMC governs firewall policy, a Check Point management server distributes it, a BMC holds out-of-band power and console control beneath the operating system entirely. Where the advisories differ is what they ask for beyond the upgrade, and it is worth being precise about that rather than generalising. Cisco's stated remediation for Secure FMC is the fixed release, with no workaround available and a direction to contact its technical assistance centre where exploitation is suspected (Cisco PSIRT, 2026-07-29). The FortiOS and BMC cases are the ones where the upgrade demonstrably does not close the exposure — a filesystem-level symlink placed before the patch, and a hash already captured from an exposed controller — and Lava's remediation framing for the latter is exposure removal rather than a fix, because there is no patch: "the main fix is simple: IPMI should not be reachable from the public internet" (Lava, 2026-07-29).

Triage: administrators legitimately authenticate to all five of these planes, so the authentication events are not the signal. The discriminators are provenance and privilege trajectory — a management-plane session from outside the administrative address range, an application or SSO token issued without a corresponding client-certificate validation, a low-privileged account authenticating to a management web interface at all, or an inbound UDP/623 session to a controller from outside the management network. On the Check Point surface specifically, an administrator session whose permission set arrives complete rather than being assembled from a role is the shape Rapid7 describes.