DAILY BRIEFING
Critical VeloCloud Zero-Day Exploited and D-Link Router Flaw Discovered
Today's briefing covers active exploitation of a CVSS 10.0 VeloCloud flaw, a D-Link router zero-day, and AI agent risks.
5 stories2 min read
At the same time, network edge security remains under pressure with zero-day disclosures affecting D-Link routers, while emerging analysis highlights how autonomous AI agents complicate identity security and lateral movement detection across enterprise environments.
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22.
- Why it matters
- Organizations using on-premises VeloCloud Orchestrators with certificate authentication face remote system compromise and downstream exploitation of connected SD-WAN Edge devices.
- What to do
- Update on-premises VeloCloud Orchestrator to fixed releases 5.2 or 6.4 immediately.
D-Link warns of max severity zero-day bug in DIR-822A routers
D-Link warned customers of a maximum-severity vulnerability (CVE-2026-86296) with public proof-of-concept (PoC) exploit code and no patch, affecting legacy DIR-822A dual-band Wi-Fi routers.
- Why it matters
- Zero-day vulnerabilities in perimeter routers expose internal networks to unauthorized remote compromise.
AI Agents Are Rewriting the Rules of Lateral Movement
Autonomous AI agents introduce new paradigms for lateral movement by iteratively testing actions, pivoting through discovered credentials, and dynamically switching tools to achieve access goals without constant human interaction.
- Why it matters
- Security teams relying solely on static role assignments face increased risk, as autonomous agents explore non-linear access paths and rapidly expand incident blast radiuses.
Webinar tomorrow: Inside real-world Google Workspace breaches
Tomorrow's webinar examines real Google Workspace breaches involving social engineering and malicious OAuth applications, from initial access through the critical first hours of incident response.
DORA Year Two: Can Your SOC Actually See the Attack?
EU regulators are shifting focus under year two of the Digital Operational Resilience Act (DORA) from policy governance to practical SOC monitoring visibility and active incident detection capabilities across ICT infrastructure.
- Why it matters
- Financial entities subject to DORA regulatory enforcement must demonstrate effective continuous monitoring and incident detection, not just formal policy compliance.
- What to do
- Assess SOC detection coverage and logging visibility across all critical financial ICT assets.
Key takeaways
- Arista confirmed active exploitation of CVE-2026-93952, a CVSS 10.0 flaw in on-premises VeloCloud Orchestrator using certificate-based authentication.
- Patches for CVE-2026-93952 are available for VeloCloud Orchestrator 5.2 and 6.4 release trains, while Arista has already patched Hosted and Dedicated versions.
- D-Link issued a warning regarding a maximum severity zero-day vulnerability impacting DIR-822A routers.
- Autonomous AI agents alter lateral movement dynamics by continuously testing non-standard paths and access rights across networks.