Arista VeloCloud CVE-2026-16812: CVSS 10 on your SD-WAN

A CVSS 10.0 is rare enough that it should stop your week. CVE-2026-16812 is one: an unauthenticated OS command injection in Arista's VeloCloud Orchestrator, already exploited in the wild, on the appliance that configures and monitors every SD-WAN link you run. No credentials required. Network access to the web interface is the whole prerequisite.

What actually happened

Arista's Security Advisory 0144 rates the flaw 10.0 on both CVSS v3.1 and v4.0 and describes it as command injection (CWE-78) in functionality that was meant to stay internal but became remotely reachable. The advisory is blunt about how it surfaced: the issue "was discovered externally and is known to be actively exploited," and Arista published three attacker IP addresses observed in the attacks.

Affected builds are on-premises VeloCloud Orchestrator only:

• VCO 5.2.x before 5.2.3.14
• VCO 6.1.x before 6.1.3.4
• VCO 6.4.x before 6.4.2.4
• VCO 7.0.x before 7.0.0.1

VeloCloud Orchestrator Hosted and Dedicated were patched before the advisory went out. VeloCloud Gateway and Edge devices aren't vulnerable. CISA added CVE-2026-16812 to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of July 30, 2026 — a two-day window, which is CISA's way of saying this is being used right now. BleepingComputer reported the exploitation alongside the advisory.

Why your SD-WAN controller matters for your business

An orchestrator is not a router. It's the thing that tells routers what to do. Whoever owns your VCO owns the routing policy for every branch, every retail location, every warehouse link — plus the credentials and topology data sitting in it. That's a better position than compromising any single site, and it's quieter.

Here's the part most small operators get wrong: you probably don't know whether you run this. SD-WAN is the kind of infrastructure a managed service provider stands up once and never mentions again. If an MSP handles your multi-site networking, the question isn't "should we patch" — it's "who is patching, and when did it happen." Ask for the running VCO version in writing today, not a reassurance that everything is covered.

Then treat the patch as step one. This flaw is remote-access-dependent, so the durable fix is the same one we push after every management-plane CVE: the orchestrator does not belong on the open internet. Put it behind an allowlist. Check Arista's published attacker IPs against your logs, because a patch closes the door and tells you nothing about who already came through.

Sources: Arista Security Advisory 0144, BleepingComputer, CISA Known Exploited Vulnerabilities Catalog.