Arista VeloCloud Zero-Day: CVSS 10, No Safe Config

Send a crafted HTTP request to an exposed VeloCloud Orchestrator. No credentials, no session, no prior foothold. The request reaches an endpoint that passes attacker-controlled input into an operating system command, and you are executing code with privileged access on the box that manages the entire SD-WAN.

That is CVE-2026-16812. It scores 10.0 on CVSS, which is the ceiling, and Arista patched it after attacks were already underway rather than before. CISA has added it to the Known Exploited Vulnerabilities catalog, which starts a remediation clock for federal agencies and is a strong signal for everyone else.

RelatedServiceNow's CVSS 9.5 Sandbox Escape Is Now Exploited

Which systems are actually affected?

VeloCloud Orchestrator On-Prem, the self-hosted build enterprises run when they want to manage their own SD-WAN rather than consume it as a service. The cloud-hosted VeloCloud offering is not in scope for this one. If you consume VeloCloud through Arista's hosted service, this is not your emergency.

If you run it yourself, patch to one of these and do it today:

Why can't you just firewall it off?

This is the detail that makes CVE-2026-16812 worse than its score suggests. The on-premises orchestrator's web interface is exposed by default, and there is no supported configuration that removes that exposure entirely. The edges have to reach the orchestrator to receive policy, so the management plane has to be reachable by design.

Plenty of critical bugs come with a workaround that buys you a maintenance window. Restrict the interface, disable the feature, drop the module, patch on Saturday. Here the mitigation advice collapses into the patch advice, because the attack surface is the product working as intended. Network ACLs in front of the orchestrator narrow the source range, and you should absolutely apply them, but the interface still has to answer somebody.

What does OS command injection mean in practice?

The class is old and boring, which is exactly why it keeps landing. Somewhere in the request-handling path, a value from the HTTP request gets concatenated into a string that is then handed to a shell. Add a separator and your own command, and the shell runs both. It is the same shape of bug that has been in the OWASP top ten for two decades.

What makes it severe here is context, not cleverness. The process handling that request runs privileged, so there is no privilege-escalation step to chain. And an orchestrator holds the credentials and tunnel configuration for the devices it manages, which means a successful exploit hands the attacker not just a server but the network's steering wheel. Traffic can be redirected, tunnels can be re-terminated, and policy can be rewritten from the place that is authorised to rewrite it.

RelatedA CVSS 10 UniFi flaw exposes 100,000 gateways to takeover

What should you do in the next 24 hours?

Patch first, then assume you might already be a victim, because this was exploited before the fix existed. Zero-day status means the window between first exploitation and your patch is not zero, whatever your normal patch SLA says.

• Update to 5.2.3.14, 6.1.3.4 or 6.4.2.4 and confirm the running version afterward, not just the installer's exit code.
• Pull orchestrator web logs for the period before patching and look for unexpected requests to management endpoints, particularly ones with shell metacharacters in parameters.
• Rotate orchestrator credentials and any API tokens it holds. If the box was executing attacker commands, its secrets are not secrets.
• Diff current edge policy and tunnel configuration against your last known-good backup. A quiet configuration change is a likelier outcome than a loud one.
• Restrict the management interface to known source ranges. It will not close the hole, but it shrinks who can reach it.

Our take

Network management planes have been the highest-yield target in enterprise security for several years now, and the industry keeps treating them as infrastructure rather than as crown-jewel applications. An SD-WAN orchestrator concentrates more effective authority than most domain controllers, yet it typically gets a fraction of the monitoring, and it is often owned by a network team without a dedicated security review cycle.

The pattern to notice is the "exposed by default with no way to unexpose" part. That is an architectural decision, made years before this bug, that removed defence in depth for every future bug in the same component. CVE-2026-16812 will be patched within the week at most shops. The design choice that made it a 10.0 instead of an 8.5 will still be there.

Original analysis by GenZTech. Vulnerability details and fixed versions per Arista's advisory as reported by BleepingComputer and The Hacker News.