Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw

### Executive Summary A critical OS command injection vulnerability (CVE-2026-16812, CVSS 10.0) in on‑premises Arista VeloCloud Orchestrator is being actively exploited in the wild; Arista published affected versions, three malicious source IPs as IoCs, and mitigation steps, and CISA added the flaw to its Known Exploited Vulnerabilities catalog. The report also briefly notes active exploitation or risk for other vulnerabilities (a Fortinet FortiOS SSL‑VPN issue and an unpatched Alibaba Fastjson RCE) and advises log preservation, patching, access restrictions, and review of administrator and outbound activity where compromise is suspected.