Security · 2h ago
Critical Arista VeloCloud Flaw Under Active Exploitation
A maximum-severity command injection vulnerability (CVE-2026-16812, CVSS 10.0) in on-premises Arista VeloCloud Orchestrator is being actively exploited. The flaw allows arbitrary code execution via OS command injection. Arista has not yet released a patch, urging immediate mitigation measures.
Meridian48 take
The CVSS 10.0 score and active exploitation make this a must-patch event for enterprises using on-prem VCO, but the lack of a fix underscores the risk of relying on proprietary SD-WAN appliances.
Read the full reporting
Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw →
The Hacker News
command-injectionarista-velocloud