A CVSS 10.0 vulnerability in Arista's on-premises VeloCloud Orchestrator is under attack, with fixes not yet available for every release.
The Hacker News reports a maximum-severity flaw, rated CVSS 10.0, in Arista's on-premises VeloCloud Orchestrator, the management plane for VeloCloud SD-WAN deployments. The vulnerability is being actively exploited in certificate-based deployments, where it can be abused to compromise the orchestrator and, through it, the wider SD-WAN fabric it controls.
According to the reporting, fixes are not yet available for every affected release train, leaving some organisations without a patch for their running version. Because the Orchestrator centrally manages distributed network edges, a compromise there has outsized reach across an enterprise's connectivity.
Why it matters: SD-WAN control planes are high-value targets, they govern routing and policy across every site. Where a patch is unavailable, restrict Orchestrator management access to trusted networks, review certificate-based authentication, monitor for anomalous administrative activity, and apply the fix the moment it ships for your release.