Zero-Day Command Injection: Critical CVSS 10 Flaw Exploited in Arista VeloCloud Orchestrator
Executive Summary
Arista Networks has issued an emergency security advisory warning of active zero-day exploitation targeting on-premises deployments of the Arista VeloCloud Orchestrator (VCO) platform. Tracked as CVE-2026-16812, the vulnerability has been assigned a maximum severity CVSS score of 10.0. Unauthenticated remote attackers are actively weaponizing this flaw to execute arbitrary system commands with root privileges, granting them full control over SD-WAN network orchestration, routing topologies, and connected edge infrastructure without requiring any user interaction or valid credentials.
Deep-Dive Technical Analysis
The vulnerability resides within the REST API administrative interface of the VeloCloud Orchestrator On-Prem software (formerly VeloCloud Orchestrator by Broadcom).
1. Root Cause: Improper OS Command Sanitization
VeloCloud Orchestrator utilizes internal management endpoints to execute system diagnostic routines and sync configuration states across connected SD-WAN edge gateways. The endpoint responsible for handling internal network telemetry parsing failed to sanitize input parameters before passing them to an underlying shell execution binary (system() call wrapper).
2. Zero-Click Authentication Bypass
Attackers send crafted HTTP POST requests containing shell metacharacters (such as backticks or ; command separators) in unvalidated JSON payload fields. Because the API route was erroneously exposed without authentication checks for internal diagnostic routines, an unauthenticated external attacker can trigger the endpoint directly over port 443.
3. Post-Exploitation & SD-WAN Hijacking
Upon successful injection, the payload executes in the context of the root user on the underlying Linux host. Threat actors have been observed dropping persistent web shells, harvesting SSH keys, and modifying SD-WAN traffic-steering policies to intercept or mirror enterprise wide-area network communications.
Industry Impact
SD-WAN orchestrators serve as the central neural network for enterprise wide-area networking, interconnecting data centers, branch offices, and cloud environments:
* Complete WAN Compromise: A breach of the central orchestrator compromises every connected SD-WAN edge gateway across the entire corporate fleet.
* Traffic Interception & Lateral Movement: Attackers can dynamically alter IPsec tunnel configurations, re-route sensitive corporate traffic through adversary-controlled nodes, or pivot into isolated internal segments.
* Targeting High-Trust Sectors: On-premises VCO instances are predominantly deployed by defense, financial, and government organizations with strict air-gap or compliance mandates.
Recommendations & Mitigations
Immediate Patch Deployment
Upgrade affected VeloCloud Orchestrator On-Prem installations immediately to the following patched versions:
Software Branch
Patched Version
Version 5.2
5.2.3.14
Version 6.1
6.1.3.4
Version 6.4
6.4.2.4
Version 7.0
7.0.0.1
Additional Security Controls
1. Restrict Management Access: Ensure VCO administrative interfaces (port 443/8443) are strictly isolated behind dedicated management VPNs or bastion hosts, and not exposed directly to the public internet.
2. Audit WAN Topologies: Review active SD-WAN routing tables, IPsec tunnel definitions, and orchestrator admin account logs for unauthorized modifications or unknown administrative API tokens.