Arista VeloCloud Orchestrator Vulnerability Added to CISA’s Exploited‑Vulnerabilities List

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has placed a critical flaw in Arista Networks' VeloCloud Orchestrator on its Known Exploited Vulnerabilities (KEV) catalog, indicating that the weakness is being leveraged by threat actors in the wild.

The vulnerability resides in the orchestration component of Arista's VeloCloud software‑defined wide area networking (SD‑WAN) solution, a platform widely deployed by enterprises and public‑sector entities to manage branch connectivity. While CISA has not disclosed a CVE identifier in its public advisory, the agency’s catalog entry flags the issue as high‑severity and confirms active exploitation.

CISA’s KEV list serves as a prioritized inventory of flaws that have been observed in real‑world attacks, helping organizations focus limited remediation resources on the most pressing threats. Adding the Arista flaw to the list signals that attackers are already targeting the orchestrator to gain unauthorized access or disrupt network operations, prompting immediate mitigation steps for any affected deployments.

Arista Networks, a leading provider of cloud‑grade networking equipment, typically responds to critical disclosures with patches or workarounds. Security researchers who first reported the issue to the vendor, as cited by Security Affairs, expect a corrective update to be issued promptly. In the interim, CISA advises administrators to apply any available mitigations, restrict network exposure of the orchestrator, and monitor for suspicious activity.

The inclusion of this vulnerability underscores the broader challenge of securing SD‑WAN infrastructures, which have become essential for remote work and multi‑cloud strategies. As more organizations adopt software‑defined networking, the attack surface expands, making timely vulnerability management crucial. Stakeholders are urged to stay abreast of CISA updates, coordinate with vendors for patch deployment, and incorporate the KEV catalog into their broader cyber‑risk assessment processes.