Maximum-Severity Zero-Day Patched Under Active Exploitation
Arista Networks has issued an emergency security advisory and patch for a maximum-severity command injection vulnerability in on-premises deployments of VeloCloud Orchestrator — the SD-WAN management platform used by enterprises and service providers to centrally manage edge networks.
The vulnerability carries a CVSS score of 10.0 and is confirmed to be actively exploited in the wild, making immediate patching an urgent priority for all affected deployments.
Vulnerability Overview
| Attribute | Value |
|---|---|
| Vendor | Arista Networks |
| Product | VeloCloud Orchestrator (on-premises) |
| CVE | Pending (advisory issued Jul 27, 2026) |
| CVSS Score | 10.0 (Maximum) |
| Type | OS Command Injection |
| Authentication Required | Unspecified (advisory pending details) |
| Patch Status | Patch available — apply immediately |
| Active Exploitation | Confirmed in the wild |
What Is VeloCloud Orchestrator?
VeloCloud (now Arista) is an enterprise SD-WAN (Software-Defined Wide Area Networking) platform. The Orchestrator is the central management plane that:
- Provisions and configures VeloCloud Edge devices at branch locations
- Manages SD-WAN policies, routing, and security profiles across the enterprise WAN
- Provides a central visibility and analytics dashboard for network operations teams
Compromise of the Orchestrator gives an attacker administrative control over the entire SD-WAN fabric, including all branch edge devices.
Technical Details
The vulnerability is a command injection flaw in the VeloCloud Orchestrator web application. Command injection occurs when user-supplied input is passed to a system shell without adequate sanitization, allowing attackers to append or inject arbitrary OS commands.
// Simplified attack flow
1. Attacker sends crafted HTTP request to vulnerable Orchestrator endpoint
2. Unsanitized input is passed to an OS-level command
3. Injected shell commands execute with Orchestrator process privileges
4. Attacker achieves RCE on the Orchestrator host
5. Full SD-WAN infrastructure exposed — all edge devices manageable by attackerWhy This Is Especially Dangerous
Compromising the VeloCloud Orchestrator allows an attacker to:
| Impact | Description |
|---|---|
| Network takeover | Modify SD-WAN routing policies across the entire enterprise WAN |
| Traffic interception | Redirect or mirror branch traffic through attacker-controlled nodes |
| Lateral movement | Access all branch networks managed by the Orchestrator |
| Persistence | Modify edge device configurations to maintain long-term access |
| Espionage | Monitor all SD-WAN traffic flows and management activity |
Affected Deployments
Only on-premises VeloCloud Orchestrator deployments are affected. Cloud-hosted Orchestrator instances managed by Arista/VMware are confirmed not affected.
Organizations running self-hosted VeloCloud Orchestrators — common in large enterprises and managed service providers who retain on-prem control — should treat this as a P0 emergency.
Immediate Actions Required
1. Apply the Patch Now
Arista has released a patch. Apply it immediately:
# Check current VeloCloud Orchestrator version
vco --version
# Follow Arista advisory instructions for upgrade path
# Consult: https://www.arista.com/en/support/advisories-notices/security-advisories/2. Isolate Orchestrators Not Yet Patched
If immediate patching is not possible:
- Restrict access to the Orchestrator management interface to trusted IP ranges only
- Block internet-facing access to the Orchestrator — it should never be publicly exposed
- Enable enhanced logging on the Orchestrator to detect exploitation attempts
- Review recent access logs for anomalous API calls or unexpected logins
3. Check for Indicators of Compromise
# Review Orchestrator web access logs for anomalous requests
tail -n 5000 /var/log/nginx/access.log | grep -E "(;|&&|\|)"
# Check for unexpected processes spawned by the Orchestrator service
ps auxf | grep -A5 vco
# Review recent system commands executed
last -F
journalctl -n 500 --no-pager4. Audit SD-WAN Policy Changes
If exploitation is suspected, audit all SD-WAN configuration changes made in the past 30–90 days:
- Review routing policy modifications
- Audit firewall rule changes at edge devices
- Check for new administrator accounts or API keys created
- Verify edge device configurations match expected baselines
Detection Signals
| Signal | Description |
|---|---|
| Unexpected OS processes spawned from the VCO service | Command injection successful |
| New admin users in the Orchestrator | Post-exploitation persistence |
| SD-WAN routing changes not initiated by network team | Attacker policy modification |
| Outbound connections from Orchestrator to unknown IPs | C2 communication |
| Access from unexpected source IPs to Orchestrator management UI | Reconnaissance or exploitation |
Long-Term Hardening
- Never expose the Orchestrator management interface to the internet — place behind VPN or zero-trust access
- Enable MFA for all Orchestrator administrator accounts
- Implement IP allowlisting on the management interface
- Subscribe to Arista security advisories for timely patching
- Conduct regular penetration testing of SD-WAN management infrastructure
- Segment the Orchestrator host from general enterprise networks