{"id":10337,"date":"2026-07-29T11:30:22","date_gmt":"2026-07-29T15:30:22","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=10337"},"modified":"2026-07-29T17:24:27","modified_gmt":"2026-07-29T21:24:27","slug":"arista-confirms-active-exploitation-of-critical-sd-wan-bug","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/arista-confirms-active-exploitation-of-critical-sd-wan-bug\/","title":{"rendered":"Arista confirms active exploitation of critical SD-WAN bug"},"content":{"rendered":"<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\"><a href=\"https:\/\/www.arista.com\/en\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Arista<\/a> is dealing with the kind of vulnerability security teams dread most: a flaw scoring a perfect 10.0 on the severity scale, no login needed to exploit it, and confirmed evidence that attackers already found it before customers did.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">The bug, tracked as CVE-2026-16812, lives in <a href=\"https:\/\/hostingdiscussion.com\/news\/nairahost-adds-windows-vps-hosting-for-businesses-locked-out-of-linux-servers\/\" target=\"_blank\" rel=\"noopener\">VeloCloud Orchestrator<\/a> On-Prem, the self-hosted version of software that companies use to centrally manage their SD-WAN networks connecting branch offices, data centers, and cloud environments. Arista&#8217;s own security advisory describes it as an OS command injection flaw that lets an attacker with no credentials at all reach privileged internal functions that nobody ever intended outside access to reach in the first place.<\/p>\n<div data-rs-index=\"80\" data-index=\"80\">\n<div tabindex=\"-1\" role=\"article\" aria-setsize=\"82\" aria-posinset=\"81\" aria-label=\"Message 81 of 82\">\n<div data-test-render-count=\"2\">\n<div class=\"contents\">\n<div class=\"mb-1 mt-[var(--msg-gap,1.5rem)] group group\/message-row\">\n<div class=\"flex flex-col items-end gap-1\">\n<div class=\"flex justify-start opacity-0 group-hover:opacity-100 group-focus-within:opacity-100 pointer-coarse:opacity-100 transition-opacity duration-150\" data-message-action-bar=\"\">\n<div class=\"text-text-300\">Here&#8217;s the uncomfortable part for anyone running this in-house: <a href=\"https:\/\/hostingdiscussion.com\/news\/arista-picks-up-velocloud-as-wan-strategies-shift-with-ai-edge-growth\/\">Arista<\/a> says the on-premises orchestrator ships with that exposure baked in by default, and there&#8217;s no setting that fully closes it off. Simply reaching the web interface is enough for an attacker to get in. Arista&#8217;s advice until a patch lands is straightforward: lock the interface down to trusted management networks only, and block the IP addresses already linked to ongoing attacks.<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">&#8220;Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator,&#8221; Arista warned, adding that a compromised orchestrator could give attackers a path into connected VeloCloud Edge devices as well, meaning the blast radius extends well past the management console itself.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Arista released three IP addresses linked to active attacks but stopped short of naming who sits behind them, when the exploitation started, or how many customers took a hit. The company also left questions from The Register unanswered. Despite those gaps, Arista&#8217;s confirmation of real-world exploitation gave <a href=\"https:\/\/hostingdiscussion.com\/news\/cisa-flags-oracle-breach-after-silent-leak-of-customer-credentials\/\">CISA<\/a> enough reason to add the bug to its Known Exploited Vulnerabilities catalog, a list that private-sector security teams widely treat as a signal for which patches need to move to the front of the line.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Arista says it already patched the hosted and dedicated versions of the orchestrator before publishing the advisory, so customers running those services don&#8217;t need to take action. Everyone else running the on-premises version needs to upgrade to 5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1 immediately. It&#8217;s a familiar pattern by now: another piece of edge-facing enterprise software joining a growing list of vendors who found out about exploitation the same way their customers did, after the fact.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Arista is dealing with the kind of vulnerability security teams dread most: a flaw scoring a perfect 10.0 on the severity scale, no login needed to exploit it, and confirmed evidence that attackers already found it before customers did. The bug, tracked as CVE-2026-16812, lives in VeloCloud Orchestrator On-Prem, the self-hosted version of software that [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7544,3587,7545,7546,3928],"class_list":["post-10337","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-arista","tag-cisa","tag-cve-2026-16812-exploit","tag-sd-wan-security-flaw","tag-velocloud"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Arista confirms active exploitation of critical SD-WAN bug - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/arista-confirms-active-exploitation-of-critical-sd-wan-bug\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Arista confirms active exploitation of critical SD-WAN bug - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"Arista is dealing with the kind of vulnerability security teams dread most: a flaw scoring a perfect 10.0 on the severity scale, no login needed to exploit it, and confirmed evidence that attackers already found it before customers did. The bug, tracked as CVE-2026-16812, lives in VeloCloud Orchestrator On-Prem, the self-hosted version of software that [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/arista-confirms-active-exploitation-of-critical-sd-wan-bug\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-29T15:30:22+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-29T21:24:27+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/arista-confirms-active-exploitation-of-critical-sd-wan-bug\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/arista-confirms-active-exploitation-of-critical-sd-wan-bug\/\",\"name\":\"Arista confirms active exploitation of critical SD-WAN bug - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-07-29T15:30:22+00:00\",\"dateModified\":\"2026-07-29T21:24:27+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/arista-confirms-active-exploitation-of-critical-sd-wan-bug\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/arista-confirms-active-exploitation-of-critical-sd-wan-bug\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/arista-confirms-active-exploitation-of-critical-sd-wan-bug\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Arista confirms active exploitation of critical SD-WAN bug\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Arista confirms active exploitation of critical SD-WAN bug - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/arista-confirms-active-exploitation-of-critical-sd-wan-bug\/","og_locale":"en_US","og_type":"article","og_title":"Arista confirms active exploitation of critical SD-WAN bug - Web Hosting News","og_description":"Arista is dealing with the kind of vulnerability security teams dread most: a flaw scoring a perfect 10.0 on the severity scale, no login needed to exploit it, and confirmed evidence that attackers already found it before customers did. The bug, tracked as CVE-2026-16812, lives in VeloCloud Orchestrator On-Prem, the self-hosted version of software that [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/arista-confirms-active-exploitation-of-critical-sd-wan-bug\/","og_site_name":"Web Hosting News","article_published_time":"2026-07-29T15:30:22+00:00","article_modified_time":"2026-07-29T21:24:27+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/arista-confirms-active-exploitation-of-critical-sd-wan-bug\/","url":"https:\/\/hostingdiscussion.com\/news\/arista-confirms-active-exploitation-of-critical-sd-wan-bug\/","name":"Arista confirms active exploitation of critical SD-WAN bug - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-07-29T15:30:22+00:00","dateModified":"2026-07-29T21:24:27+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/arista-confirms-active-exploitation-of-critical-sd-wan-bug\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/arista-confirms-active-exploitation-of-critical-sd-wan-bug\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/arista-confirms-active-exploitation-of-critical-sd-wan-bug\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"Arista confirms active exploitation of critical SD-WAN bug"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":106,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10337","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=10337"}],"version-history":[{"count":2,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10337\/revisions"}],"predecessor-version":[{"id":10339,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10337\/revisions\/10339"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=10337"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=10337"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=10337"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}