Arista Patches Maximum-Severity VeloCloud Orchestrator Zero-Day Under Active Exploitation

What Happened

Arista has released patches for a maximum-severity command injection vulnerability affecting on-premises deployments of VeloCloud Orchestrator, according to BleepingComputer. The vulnerability was disclosed as a zero-day already being exploited in the wild at the time of patching, meaning attackers had a working exploit before a fix was available.

Why It Matters

VeloCloud Orchestrator is the centralized management plane for VMware/Arista SD-WAN deployments, giving it a privileged view into and control over an organization's WAN edge. A command injection flaw rated at maximum severity in this component is significant: successful exploitation could allow an attacker to execute arbitrary commands on the orchestrator itself, potentially exposing configuration data, credentials, or a pivot point into connected branch and edge infrastructure. Because this is confirmed as actively exploited rather than a theoretical finding, any organization running on-premises VeloCloud Orchestrator should treat this as an urgent, time-sensitive risk rather than routine patch maintenance.

What Defenders Should Do Now

• Identify all on-premises VeloCloud Orchestrator instances in your environment and prioritize applying Arista's patch as soon as it can be validated in your change process.
• Review orchestrator access logs for unexpected or anomalous administrative commands, unusual process spawning, or command-line activity inconsistent with normal management operations.
• Check for unfamiliar accounts, modified configurations, or new outbound connections originating from the orchestrator host, which could indicate post-exploitation activity.
• Restrict and monitor management-plane access to VeloCloud Orchestrator (VPN-only, allow-listed source IPs) to reduce exposure while patching is completed across the fleet.
• Watch for follow-up advisories from Arista or VMware detailing indicators of compromise or exploitation specifics as the incident is further investigated.

Developing Story

Details on the exploitation campaign, affected version ranges, and any indicators of compromise are still emerging. This post will be updated as more information becomes available; for the latest details, see the original report from BleepingComputer.