#arista

CVE-2026-93952: CVSS 10.0 vulnerability in Arista VeloCloud Orchestrator 🔗 https://cybersecurefox.com/en/cve-2026-93952-arista-velocloud-orchestrator-cvss-10-active-exploitation #CVE-2026-93952 #VeloCloud #Orchestrator #Arista #CVSS #10.0 #SD-WAN

No credentials required. Attackers are already using this. Please patch your on-premises VeloCloud Orchestrator installations immediately before HR schedules a follow-up. Reward: You've been awarded the "Meets Some Criteria" participation plaque. It is not framed. https://osintsights.com/arista-warns-of-active-exploits-in-velocloud-orchestrator-flaw?utm_source=mastodon&utm_medium=social #CyberSecurity #ZeroDay #Arista #VeloCloud #CriticalVulnerability #PatchedOrPerish (2/2)

CVE-2026-16812: Critical Arista VCO Flaw Exploited 🔗 https://cybersecurefox.com/en/arista-velocloud-orchestrator-cve-2026-16812-command-injection #arista #velocloud #orchestrator #cve-2026-16812 #sd-wan #command #injection #cisa #kev

Arista addresses CVE-2026-16812, a critical vulnerability in VeloCloud Orchestrator actively exploited to gain unauthenticated remote code execution. #Arista #VeloCloud #Cybersecurity #CVE202616812 #RCE https://meterpreter.org/arista-velocloud-orchestrator-cve-2026-16812/?utm_source=mastodon&utm_medium=jetpack_social

CISA KEV additions on July 27 flag two known exploited vulnerabilities: Arista VeloCloud CVE-2026-16812 and FortiOS CVE-2025-68686. Patch both now. #CISA #KEV #Arista #VeloCloud #Fortinet #FortiOS #CVE #ExploitedInTheWild #Cybersecurity https://securityonline.info/cisa-kev-arista-velocloud-fortios/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-16812, a VeloCloud command injection scored CVSS 10, is exploited in the wild. Patch VeloCloud Orchestrator now, plus two related bugs. #VeloCloud #Arista #CVE202616812 #CommandInjection #ExploitedInTheWild #VCO #SSRF #Cybersecurity https://securityonline.info/velocloud-command-injection-cve-2026-16812/?utm_source=mastodon&utm_medium=jetpack_social

I learned a few things about #Arista switches in the process.

• there's a full linux OS underneath, you can run anything on it, including plain bash

• the aboot loader also has bash

• there are 2 versions of the aboot loader with different zip formats used for loading EOS

• I couldn't upgrade the older boot loader to a newer one

• but you can repackage the newer one in the older format yourself

Their API & config setup is a pleasure to use in comparison to the fs.com ones I've got locally. Much more accessible and comprehensive documentation.