Arista disclosed on September 22 that attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator, the server that manages Edge devices across a VeloCloud SD-WAN. Tracked as CVE-2026-93952 and rated 10.0, it lets a remote attacker with no login reach internal functions and affect the orchestrator host, but only where Edges authenticate using certificates. A compromised orchestrator exposes the data it manages and can give access to the Edge devices under it. Arista says the flaw was found externally and is known to be actively exploited. Fixed releases exist for the 5.2 and 6.4 trains, with 6.1 and 7.0 still pending.
Arista patched a critical vulnerability in on-premises VeloCloud Orchestrator, the console that configures and manages VeloCloud SD-WAN deployments, that is already being exploited. Tracked as CVE-2026-16812 and scored 10.0, it is an unauthenticated operating-system command injection that lets a remote attacker reach privileged functionality meant only for internal use. Arista warns successful exploitation can compromise the confidentiality, integrity, and availability of the orchestrator and everything it manages. There is no configuration that prevents exposure, since the web interface is reachable by default. CISA added it to its exploited-vulnerabilities catalog. Hosted and Dedicated deployments were fixed before the advisory and are not affected.
TrustStrike Labs