🛡️ **BREAKING: Arista VeloCloud Orchestrator Zero-Day Under Active Attack — Maximum Severity**
Published Thursday, September 24, 2026 at 11:38 AM PT BLUF: Arista Networks’ on-premises VeloCloud Orchestrator is actively being exploited via a CVSS 10.0 zero-day vulnerability affecting SD-WAN management deployments. Patches exist but not all vulnerable versions have been updated. Organizations running unpatched on-premises VCO must apply fixes immediately. DETAILS Vulnerability: Maximum-severity (CVSS 10.0) flaw in on-premises VeloCloud Orchestrator enables remote attackers to gain unauthorized access to the SD-WAN management platform and its controlled edge devices. Exploitability: Active in-the-wild exploitation confirmed; certificate-based VCO configurations confirmed as attack vector. Affected scope: On-premises VCO deployments only; cloud-hosted instances status not explicitly confirmed in available material, though Arista’s advisory applies to on-premises. Patch status: Arista has issued patches, but as of advisory, not all vulnerable versions have been remediated — deployment versions vary across customer installations. Access implications: Successful exploitation grants attackers direct access to the platform that orchestrates SD-WAN subscriptions and controls all connected edge appliances. IMPACT ...