Arista Networks has released critical patches for a maximum-severity security flaw in its VeloCloud Orchestrator (VCO) on-premises management platform, warning that the vulnerability is already being actively exploited by attackers. The flaw, tracked as CVE-2026-16812, carries the maximum CVSS score of 10.