Arista's VeloCloud Orchestrator — the box that runs an entire company's SD-WAN — has a flaw so severe it maxes out both CVSS scoring systems at a full 10.0, and Arista has confirmed real attackers are already using it. No login required at all.
What a 10.0 actually means here
Most "critical" CVEs land somewhere in the 9-point range because some precondition softens them slightly — local access needed, a specific config required, partial impact only. A true 10.0 doesn't get any of that cover: it's CWE-78 OS command injection, reachable over the network, requiring nothing an attacker doesn't already have just by finding the web interface. Since VCO is the centralized control plane for an entire SD-WAN deployment, compromising one orchestrator doesn't just compromise a server — it hands an attacker a management pivot point into every branch-office edge device that orchestrator runs.
Affected vs fixed versions
5.2.x
Value
Vulnerable before 5.2.3.14 — fixed in 5.2.3.14
6.1.x
Value
Vulnerable before 6.1.3.4 — fixed in 6.1.3.4
6.4.x
Value
Vulnerable before 6.4.2.4 — fixed in 6.4.2.4
7.0.x
Value
Vulnerable before 7.0.0.1 — fixed in 7.0.0.1
Value
5.2.x
Vulnerable before 5.2.3.14 — fixed in 5.2.3.14
6.1.x
Vulnerable before 6.1.3.4 — fixed in 6.1.3.4
6.4.x
Vulnerable before 6.4.2.4 — fixed in 6.4.2.4
7.0.x
Vulnerable before 7.0.0.1 — fixed in 7.0.0.1
The three IPs Arista is actually seeing
Arista's advisory names three IP addresses observed conducting attacks: 8.19.75.217, 206.72.242.124, and 206.72.242.162. That's a real, right-now hunting list for anyone running on-prem VCO — check inbound connections to your orchestrator's web interface against those addresses today. It's also worth the caveat every IOC list deserves: attacker infrastructure rotates fast, and a clean log against these three specific addresses is not the same thing as a clean bill of health.
VeloCloud Orchestrator is the centralized brain for enterprise SD-WAN — exactly why a flaw here has such a wide blast radius. · Unsplash
Why this is worse than a normal 'critical' bug
A CVSS 9.x critical usually still asks something of the attacker — valid low-privilege credentials, local network position, a specific misconfiguration. This one asks for nothing beyond finding the web interface, which is precisely what tips it into the 10.0 band: full compromise of confidentiality, integrity, and availability, with zero authentication as a precondition. Control-plane infrastructure has had a genuinely rough year across the board — Cisco's own SD-WAN Manager took a root-access bug earlier in 2026, Cisco's firewall management tool shipped with a static credential, and VMware's hypervisor got a VM-escape patch that lets a single virtual machine take over its host. The pattern across all of them: attackers are deliberately targeting the layer that manages everything else, because compromising the manager beats compromising one endpoint at a time.
Identify every on-prem VCO instance in your environment — hosted or Arista-managed VCO was already fixed before disclosure and isn't your exposure.
2
Upgrade to 5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1 depending on your current branch — Arista isn't recommending a partial mitigation instead of patching.
3
Check logs for connections from 8.19.75.217, 206.72.242.124, and 206.72.242.162 — Arista's advisory flags these as observed attacker infrastructure.
4
If you're a federal agency bound by CISA's KEV catalog, the 3-day BOD 26-04 clock started the day this was added — that's a deadline, not a guideline.
Verdict
My take
A perfect 10.0 with confirmed active exploitation and zero authentication required is about as close to 'drop everything' as CVE scoring gets. If your team is still routing this through a normal patch-cycle SLA instead of an emergency change window, that decision is the actual risk right now — not the vulnerability itself.
Quick answers
Does this affect Arista's cloud-hosted VeloCloud service?
No — Arista's advisory states only on-premises VCO deployments are vulnerable; hosted and dedicated VCO instances it operates were already patched before disclosure.
Do I need valid login credentials to be at risk?
No, and that's what makes this a 10.0 — the advisory explicitly states no VCO tenant or operator credentials are required, just network reachability to the web interface.
Is this actually being used in real attacks, or just theoretically exploitable?
Actively exploited. Arista's advisory states the issue is known to be exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog on that basis.
Watch for follow-on reporting naming which sectors got hit first — that detail usually surfaces a few weeks after a KEV listing, once incident responders start comparing notes. In the meantime, the broader context matters: Microsoft's own record 569-CVE Patch Tuesday and SharePoint's ongoing exploited-in-the-wild wave both point the same direction — 2026 has more critical, actively-exploited infrastructure bugs landing per month than most security teams are staffed to triage. A perfect-10 unauthenticated SD-WAN takeover is exactly the kind of thing that should jump the queue.
