What Changed
Arista has patched CVE-2026-16812 (CVSS 10.0), an OS command injection flaw in on-premises VeloCloud Orchestrator (VCO) that attackers exploited as a zero-day. CISA added it to the KEV catalog on July 27 with a July 30 deadline for federal civilian agencies.
Fixed releases are 5.2.3.14, 6.1.3.4, 6.4.2.4 and 7.0.0.1; versions below those in the 5.2.x, 6.1.x, 6.4.x and 7.0.x lines are affected. Arista says Hosted and Dedicated VCO deployments were patched in advance and that VeloCloud Gateways and Edges are not affected.
Why This Is An Operations Problem
The orchestrator is the control point for an SD-WAN estate. Command injection there can give an attacker a privileged position to reconfigure or observe branch connectivity across many sites, which reaches far more sites than a single compromised edge device.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What To Verify First
- Identify every on-premises VCO and upgrade it to a fixed release.
- Restrict management access to the orchestrator to trusted networks.
- Search logs and network telemetry for the indicator IPs Arista shared: 8.19.75.217, 206.72.242.124 and 206.72.242.162.
- Review recent configuration changes pushed from the orchestrator to edges.
What Teams May Be Underestimating
Hosted customers may assume they are covered, but on-premises orchestrators are entirely the operator’s responsibility. Confirm deployment type before closing the ticket.
The same July 27 KEV update also added FortiOS CVE-2025-68686, so teams running both Fortinet and Arista edge infrastructure should handle the two entries in the same change window rather than treating them as separate backlog items.
Source Context
This item was rebuilt from the following primary sources and original reporting:
- The Hacker News: Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw
- BleepingComputer: Arista patches VeloCloud Orchestrator zero-day exploited in attacks
- CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (July 27, 2026)
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
