10.0 CVSS. Not the problem.
Arista VeloCloud Orchestrator's command injection flaw, tracked as CVE-2026-16812, is under active exploitation. The vulnerability allows for arbitrary code execution, highlighting the need for immediate patching.
This is not a vulnerability problem, but a patch governance failure. 42% of exploited vulnerabilities in 2025 were weaponized before public disclosure, according to CrowdStrike's Global Threat Report 2026.
The defensive math: -> Prioritize patching on-prem VCO deployments to prevent supply chain attacks, with a goal of 100% patch coverage within 14 days. -> Implement a vulnerability exploitation-window monitoring system to detect potential zero-day attacks, aiming for a 24-hour detection window. -> Conduct regular security audits to identify and address potential security issues before they can be exploited, with a target of quarterly audits.
Can your team patch 100% of critical vulnerabilities within 14 days of disclosure?
https://tomodachi.work/zanshin/