Arista is dealing with the kind of vulnerability security teams dread most: a flaw scoring a perfect 10.0 on the severity scale, no login needed to exploit it, and confirmed evidence that attackers already found it before customers did.
The bug, tracked as CVE-2026-16812, lives in VeloCloud Orchestrator On-Prem, the self-hosted version of software that companies use to centrally manage their SD-WAN networks connecting branch offices, data centers, and cloud environments. Arista’s own security advisory describes it as an OS command injection flaw that lets an attacker with no credentials at all reach privileged internal functions that nobody ever intended outside access to reach in the first place.
“Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator,” Arista warned, adding that a compromised orchestrator could give attackers a path into connected VeloCloud Edge devices as well, meaning the blast radius extends well past the management console itself.
Arista released three IP addresses linked to active attacks but stopped short of naming who sits behind them, when the exploitation started, or how many customers took a hit. The company also left questions from The Register unanswered. Despite those gaps, Arista’s confirmation of real-world exploitation gave CISA enough reason to add the bug to its Known Exploited Vulnerabilities catalog, a list that private-sector security teams widely treat as a signal for which patches need to move to the front of the line.
Arista says it already patched the hosted and dedicated versions of the orchestrator before publishing the advisory, so customers running those services don’t need to take action. Everyone else running the on-premises version needs to upgrade to 5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1 immediately. It’s a familiar pattern by now: another piece of edge-facing enterprise software joining a growing list of vendors who found out about exploitation the same way their customers did, after the fact.
