Skip to content
COOEY

FAIL › dossier

VeloCloud Orchestrator

PRODUCT

· dossier confidence 20%

Arista Networks' VeloCloud Orchestrator is a critical SD-WAN management plane that has suffered severe, actively exploited security flaws in 2026. The platform's improper input validation and command injection vulnerabilities allow remote attackers to compromise the host and gain privileged access, particularly in certificate-based deployments.

Failure events
2
Zero-days
0
RCEs
1
On KEV
2
Critical
0
Worst shame
85
PROFILE
CategoryNetwork Security / SD-WANWhat they doArista Networks' VeloCloud Orchestrator (VCO) is the management and control plane for the VeloCloud SD-WAN platform, handling configuration, policy, and telemetry for distributed Edge appliances. Websitehttps://www.arista.com ↗
SECURITY POSTURE

Arista's VeloCloud Orchestrator has a critical security track record with multiple high-severity, actively exploited vulnerabilities in 2026, including improper input validation and command injection flaws that grant remote attackers privileged access and host compromise.

Notable failures
  • CVE-2026-93952: Improper input validation allowing unauthenticated remote privilege escalation and host compromise
  • CVE-2026-16812: Command injection vulnerability granting attackers privileged access to internal systems and data
Patterns: Actively exploited critical flaws in on-premises management planes; Vulnerabilities specifically targeting certificate-based authentication setups; Delayed patching across multiple release trains (e.g., 6.1 and 7.0 affected as of Sep 2026)
FAILURE HISTORY · 2
DATEEVENTSEVSUMMARY
2026-09-22 CVE-2026-93952 high Arista VeloCloud Orchestrator suffers an actively exploited improper input validation flaw allowing remote attackers to access privileged functionality and compromise the host.
2026-07-27 CVE-2026-16812 high Arista's VeloCloud Orchestrator has a command injection vulnerability actively exploited in the wild, potentially granting attackers privileged access to internal systems and data managed by the orchestrator.
DOSSIER SOURCES
Open questions: Arista's founding year and headquarters location are not explicitly confirmed in the provided web evidence, requiring external knowledge to fill these fields.
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-23 04:43:10.004301+00:00