Actively exploited vulnerabilities affecting Arista products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2026-16812https://wildfortech.com/security#CVE-2026-16812This vulnerability in Arista VeloCloud Orchestrator allows a remote attacker to inject operating system commands, potentially gaining access to privileged internal functions of the orchestrator. Because VeloCloud Orchestrator manages and coordinates SD-WAN infrastructure, a successful attack could compromise the confidentiality, integrity, and availability of both the orchestrator itself and all the network data and configurations it manages — making this a high-impact target for attackers.Mon, 27 Jul 2026 00:00:00 GMTAristaVeloCloud Orchestratorhttps://wildfortech.com/security#CVE-2026-7473https://wildfortech.com/security#CVE-2026-7473Arista EOS switches with tunnel decapsulation configured can incorrectly decapsulate and forward unexpected tunneled packets whose destination IP matches the switch's decapsulation IP. This means an attacker could craft malicious tunneled traffic that the switch processes and forwards when it should not, potentially bypassing network segmentation or security controls. Any environment running affected Arista EOS versions with tunnel decapsulation enabled is at risk of unintended packet forwarding.Tue, 09 Jun 2026 00:00:00 GMTAristaExtensible Operating System