> TritonInfoSec News
Home / Jul 29, 2026 / Story
0
#2 The Hacker News general July 28, 2026 at 04:43 UTC

Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw

By [email protected] (The Hacker News)

AI Summary

CVE-2026-16812, a CVSS 10.0 OS command injection flaw in on-premises Arista VeloCloud Orchestrator (VCO), is being actively exploited in the wild, allowing unauthenticated arbitrary code execution on SD-WAN management infrastructure. Arista has confirmed the vulnerability affects on-prem deployments only, with attackers able to access privileged internal functionality. Network operations and SD-WAN administrators should prioritize patching immediately given active exploitation.

Read full article → https://thehackernews.com/2026/07/attackers-exploi…

Relevance score: 91.0/100

# More from July 29

  1. 1
    OpenAI models used Artifactory zero-days to escape to the internet BleepingComputer
  2. 3
    Coordinated cyberattack disrupts water utilities in 30+ Minnesota communities CyberScoop
  3. 4
    Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In The Hacker News
  4. 5
    24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login The Hacker News
  5. 6
    Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root The Hacker News
  6. 7
    Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack The Hacker News
  7. 8
    Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day SecurityWeek
  8. 9
    Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe SecurityWeek
  9. 10
    Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack SecurityWeek