Digital Warfare Podcast Daily Brief #137 July 28, 2026

The Digital Warfare Podcast · Jul 28, 2026 · 3m · transcript

Summary

Arista has patched CVE-2026-16812, a maximum-severity OS command-injection vulnerability affecting on-premises VeloCloud Orchestrator deployments. The flaw requires network access to the web interface but does not require tenant or operator credentials. Arista confirms that it is already being actively exploited.

Successful exploitation may compromise the orchestrator host and the data it manages, potentially exposing configurations, device inventories, credentials, certificates, databases, and cryptographic keys. Because the orchestrator manages SD-WAN infrastructure, a compromise…