Developing2 outlets · over 6 hours

Arista patches VeloCloud Orchestrator zero-day exploited in attacks

Arista patched CVE-2026-16812, a maximum-severity command injection flaw in on-premises VeloCloud Orchestrator, actively exploited in attacks. The vulnerability allows unauthenticated remote attackers to access privileged internal functionality. Fixed versions include 5.2.3.14, 6.1.3.4, and 6.4.2.4.

Read the full brief

The story so far

ByteBrief

Skimming the internet so you don't have to

Arista patches VeloCloud Orchestrator zero-day exploited in attacks - the story so far | ByteBrief