Arista patches VeloCloud orchestrator flaw being exploited

Arista Networks has released critical patches for a maximum-severity security flaw in its VeloCloud Orchestrator (VCO) on-premises management platform, warning that the vulnerability is already being actively exploited by attackers. The flaw, tracked as CVE-2026-16812, carries the maximum CVSS score of 10.0 and allows unauthenticated remote attackers to execute operating system commands on the VCO host, potentially compromising the entire software-defined wide area network (SD-WAN) infrastructure it manages.

The vulnerability is an unauthenticated command injection flaw that grants access to privileged internal functions within the VCO. Arista stated in an advisory that successful exploitation could compromise the confidentiality, integrity, and availability of the orchestrator and all data it manages. The company emphasized that the vulnerable functionality was intended for internal use only and was not meant to be remotely accessible, but the VCO web interface is exposed by default with no configuration setting available to disable this exposure. Attackers require only network access to the web interface, needing no credentials.

Patches are available for affected on-premises...