OS Command Injection (CVE‑2026‑16812) in Arista VeloCloud Orchestrator On‑Prem Threatens Enterprise SD‑WAN
What It Is — Arista’s VeloCloud Orchestrator (on‑premises deployment) contains an OS command‑injection flaw (CVE‑2026‑16812). An unauthenticated remote attacker can inject arbitrary operating‑system commands, potentially gaining privileged access to the orchestrator host.
Exploitability — The vulnerability is rated CVSS v3.1 8.8 (High) and is exploitable over the network; no public exploit has been observed, but the attack vector is remote and requires only network access to the orchestrator interface.
Affected Products — Arista VeloCloud Orchestrator (on‑premises version(s) listed in the CISA KEV advisory).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls that capture, prioritize, and remediate high‑severity flaws across critical network infrastructure.
- Provides audit‑ready evidence that an organization is actively monitoring and patching SD‑WAN components, a key trust signal for enterprise buyers.
- Highlights the importance of segregation and logging around orchestration platforms to limit the impact of a compromised host.
Recommended Actions
- Review the Arista security advisory and apply any vendor‑released patches immediately.
- Verify that your vulnerability‑scanning tools include the VeloCloud orchestrator in their asset inventory.
- Enforce network segmentation for the orchestrator host and enable strict outbound command filtering.
- Capture remediation evidence (patch version, scan results) in your control repository for audit readiness.
- Update your incident‑response playbook to include OS‑command‑injection scenarios for SD‑WAN components.
Source: CISA KEV – CVE‑2026‑16812