Vendor

Arista

Security vulnerabilities in Arista products, including the VeloCloud Orchestrator SD-WAN platform. Management-plane flaws in SD-WAN infrastructure carry broad network impact across every connected site.

CVEs

CVE-2026-16812

[ CRITICAL ] CVSS 10.0 kev

Arista VeloCloud Orchestrator OS Command Injection

CVSS 10.0 critical. Remote attackers can inject OS commands into Arista VeloCloud Orchestrator On-Prem, compromising the SD-WAN management plane.

Arista / VeloCloud Orchestrator On-Prem Jul 27

Articles

~/articles/2026-07-27-arista-velocloud-cve-2026-16812-kev

● Breaking

arista

Arista VeloCloud Orchestrator Hits CISA KEV

CISA adds CVE-2026-16812 to KEV: CVSS 10.0 OS command injection in Arista VeloCloud Orchestrator On-Prem. Remote exploitation confirmed. Patch immediately.

Jul 27 read →