The Watch

CVE-2026-16812 sits in VeloCloud Orchestrator, and patching it does not undo what came before. VCO writes policy and routes to every managed branch device, and that configuration persists independently of the orchestrator. An adversary who used the bug before the maintenance window can leave behind tunnels, routes, and ACL changes that survive the upgrade. Arista's detection guidance points at unusual encoded web requests, meaning payload obfuscation via URL, percent, or base64 encoding. Existing VCO web logs are therefore a retroactive compromise-assessment dataset.

The remediation order that matters

1. Patch or isolate today. Fixed builds are 5.2.3.14, 6.1.3.4, and 6.4.2.4 or later, per Cyberpresso. Where a window blocks the upgrade, ACL the management interface to administrative networks and block the three attacker IPs in Arista's advisory.
2. Assume pre-patch exposure. Grep VCO web logs for encoded request patterns back to 1 July. Diff every branch device configuration against a known-good baseline. Rotate all VCO operator and tenant credentials plus API tokens.
3. Close the other two doors. On-prem TeamCity carries unauthenticated OS command execution, per The Hacker News. Check Point Security Management, Multi-Domain Management, and Security Gateways carry CVE-2026-16232 (CVSS 9.3), in CISA's KEV catalogue since 22 July with a 25 July federal deadline that has now passed, per SANS NewsBites.

Where the sources agree, and where they add

Cyberpresso and The Hacker News agree on severity, exploitation status, and the control-plane framing. Cyberpresso adds the fixed build numbers and the IOC guidance that make the work executable. SANS NewsBites independently places the Arista flaw inside the KEV batch alongside SharePoint CVE-2026-50522, FortiOS CVE-2025-68686, and MongoDB CVE-2026-13072, sequenced under BOD 26-04's risk-based model rather than blanket deadlines. Three independent reports converging is why this reads as high confidence rather than one vendor's alarm.

Why TeamCity is the sleeper

An unauthenticated RCE on a build server hands over the material that authenticates software to customers: cloud IAM credentials, service tokens, repository deploy keys, and code-signing keys. Patching is the easy half. Rotation is the actual remediation, and build configurations plus installed plugins need review for steps added in the 30 days before the patch landed. Skip that, and a host incident becomes a downstream supply-chain incident that customers find first.

Three unauthenticated flaws in one window, all on infrastructure that issues trust to everything below it. The patch stops the next intruder; only rotation and config diffing remove the last one.

One honest caveat: affected version ranges and CVE identifiers for the TeamCity item are thin in the available reporting. Pull the JetBrains advisory directly before the change ticket gets written. Headline severity is not a patch plan.

The mechanism defeats a control most travel-security checklists mark green. The actor reaches the captive portal via exposed management interfaces or weak administrator credentials on the venue gateway, edits device configuration, and owns DNS resolution for every client on that network. An endpoint pinned to a hard-coded public resolver still emits an unencrypted query. The gateway reads it, forges a reply, and redirects it before it ever reaches Google. Pinning a resolver changes the destination. It does not protect the path.

Why containment breaks, not just prevention

ReliaQuest reports the redirect techniques paired with theft of legitimate OAuth tokens through device code flow abuse, per SANS NewsBites. A phished password is recoverable: reset, revoke, done. A stolen device code token is a valid, MFA-satisfied credential, Conditional Access honours it, and it survives a password reset. A runbook that opens "suspected credential compromise" with a password change does not contain this. Token revocation and sign-in session invalidation go first. Device code flow should be off by default until a named business owner justifies it for kiosks, IoT, or CLI tooling.

Control efficacy, honestly scored

No single control covers the chain. Each layer is cheap and none is sufficient alone, which is a defence-in-depth problem rather than a product purchase.

The detection worth building

The highest-fidelity replay signal is a sequence, not an indicator. A Microsoft 365 sign-in from a hospitality or conference-venue IP range, followed by a token refresh or mailbox rule creation from a different ASN. Build that correlation. Then hunt 90 days of sign-in logs for device code grants from unfamiliar ASNs. Roughly a third of observed attacks also poisoned Web Proxy Auto-Discovery, both the DHCP option and the DNS lookup, so WPAD disablement goes in the same change ticket.

Evidence confidence is medium. This is one authoritative primary account of an ongoing campaign with published IOCs, not three corroborating reports. That justifies hours of configuration work and a log hunt. It does not justify rewriting a travel programme around a single actor.

Retire "we force public DNS" from your control inventory. Against gateway-level DNS forging it is a documented false positive, and the token it protects may already be gone.

The actor is ShinyHunters. The victim is DentaQuest. The exfiltration window was four days, 17-20 May 2026, per Cyberpresso. Intruders accessed names, addresses, Social Security numbers, Medicaid and Medicare IDs, and clinical dental and vision diagnoses, treatments, and billing. ShinyHunters claimed 234 GB and published it after negotiations failed. Nothing was encrypted, so there is no key to buy and no backup to restore. The data is permanently public. Twenty-four months of credit monitoring across more than 23 million people is a nine-figure remediation bill before the first class action is filed.

The controls that would have mattered

An extortion playbook whose happy path is "restore from backup" is prepared for a different attack. Data-theft-only extortion remains economically viable. The controls that bite sit upstream of encryption:

• Egress monitoring and DLP on bulk data movement. The only place a four-day exfiltration window is observable.
• Exfiltration detection tuned to volume and destination, not file hashes.
• A funded notification cost line in the incident budget. HIPAA, state notification, and CMS scrutiny attach automatically at this scale.

The second failure mode: total communications loss

SANS NewsBites reports that on 26 July, South Carolina system AnMed Health disclosed a malware-driven disruption that forced it to temporarily close 79 of its 106 facilities across South Carolina and Georgia. Computer systems, phones, and internet connectivity were all unavailable. AnMed comprises four hospitals and more than 60 medical practices. Most business continuity plans assume phones survive. This one did not, and that single assumption decides whether an incident bridge exists at all.

The surrounding pattern is the part to brief upward. Same news cycle: Anatomic and Clinical Laboratory Associates notified nearly 170,000 individuals of PHI compromise. ZenPatient had an intruder in its telehealth platform from 5 December 2025 to 12 February 2026. Saint Pete MRI, Carlyle Senior Care, Penobscot Valley Hospital, Whitfield Regional Hospital and others also disclosed incidents. Twelve or more providers in one news cycle reads as a targeting pattern, and HIPAA liability attaches to covered entities and business associates alike.

Where the two sources diverge in emphasis

Cyberpresso frames DentaQuest as economics: publication-without-encryption keeps working, so fund exfiltration detection. SANS NewsBites frames AnMed as resilience: third-party and business-associate continuity assumptions need re-testing. Both readings hold, and they point at different budget lines. Organisations holding PHI or PII at scale should read DentaQuest as detection spend. Organisations depending on a healthcare partner should read AnMed as a vendor resilience question, asked in writing.

Backups answered the last generation of extortion. When the adversary's only leverage is publication, the controls that matter are egress visibility and a notification budget you have already modelled.