Arista Networks Patches Critical VeloCloud Orchestrator Flaw Under Active Attack

What happened

On July 27, 2026, Arista Networks published Security Advisory 0144 disclosing CVE-2026-16812, an OS command injection vulnerability in VeloCloud Orchestrator On-Prem with a CVSS score of 10.0. The flaw allows unauthenticated remote attackers to access privileged internal functionality through the VCO web interface, which is exposed by default with no configuration capable of removing that exposure entirely. Arista confirmed attackers were already exploiting the vulnerability and provided three IP addresses observed conducting attacks. The same day, CISA added the flaw to its Known Exploited Vulnerabilities catalog and set a July 30 deadline for federal agencies to remediate under Binding Operational Directive 26-04. Patches are available in VeloCloud Orchestrator versions 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1. Cloud-hosted and dedicated VCO deployments were patched before the public advisory and are not affected.

Why it matters

VeloCloud Orchestrator is the central management platform for enterprise SD-WAN deployments, holding routing policies, VPN configurations, device credentials, certificates, and cryptographic keys for all connected branch offices and edge devices. A compromise of the orchestrator is not equivalent to losing a single server-it grants attackers administrative control over the entire managed WAN. They can push routing changes to every branch site, intercept VPN traffic, invalidate legitimate credentials, and propagate access across the network. Arista explicitly stated the vulnerability stems from a design constraint-privileged internal API functionality shares the same web interface as the management console with no access control layer separating them. This architectural decision, not a coding error, left internal functions accessible to anyone on the network without authentication. The confirmed active exploitation and CISA's rapid KEV listing signal that attackers have already recognised the strategic value of compromising SD-WAN orchestration layers.

Bigger picture

CVE-2026-16812 continues a sustained pattern of attacker focus on SD-WAN management and orchestration platforms throughout 2025 and 2026. Mandiant documented nation-state actors targeting SD-WAN infrastructure at telecommunications providers from late 2025 through at least March 2026. Cisco's Catalyst SD-WAN platform logged seven separately exploited zero-days in 2026 alone, prompting CISA to issue Emergency Directive 26-03 specifically for Cisco SD-WAN systems. Security analysts characterise this as a *living off the edge* strategy-advanced threat actors prioritise compromising network management layers rather than endpoints because the orchestrator's position in the network hierarchy provides visibility into traffic flows, routing policies, and device credentials across entire enterprise environments. The Arista disclosure arrives just weeks after CISA added a Fortinet FortiOS SSL-VPN bypass flaw to the KEV catalog, underscoring continued pressure on edge-facing enterprise infrastructure.

What to watch

Organisations running on-premises VCO deployments should immediately restrict web interface access to trusted management networks and block the three known attacker IP addresses. If patching is delayed, review VCO logs for unusual web requests with encoded characters, unexpected outbound traffic from the VCO host, unauthorised configuration changes, or suspicious access to device inventories and credentials. Customers running end-of-support VCO versions not covered by the fixed releases should contact Arista Technical Assistance Center to discuss upgrade options. If compromise is suspected, preserve all logs and filesystem timestamps before beginning remediation-applying the patch does not evict an attacker already inside. Post-compromise steps include rotating all credentials, reviewing administrator account activity, and validating the integrity of every managed VeloCloud Edge device. Watch for further disclosure on attacker attribution, campaign scope, and whether additional IP addresses or exploitation methods emerge.