On October 22, 2026, Arista disclosed that its on-premises VeloCloud Orchestrator (VCO) carries an actively exploited SQL injection: any authenticated user, down to the Enterprise Read Only role, can become the superuser operator. If you self-host a VCO, upgrade immediately and assume every account — read-only included — has already been abused.
On October 7, 2026, Cisco shipped a security hardening release that closes seven vulnerabilities across the entire Meraki lineup — MX, MS, MR, MV, MG and Campus Gateways — up to CVSS 9.6, discovered internally with the help of frontier AI models. With no workaround available, a firmware upgrade is the only exit for hardware that carries the corporate network.
FatPipe MPVPN, WARP and IPVPN appliances on the end-of-life 10.1.2r60p100 firmware expose an OS command injection and a stack buffer overflow that both yield an unauthenticated root shell. Move to a supported release and lock down the management interface, which ships disabled by default.
CVE-2026-76504 lets an unauthenticated attacker bypass Catalyst SD-WAN Manager authentication through URI encoding and gain admin rights. There is no workaround: patch immediately and inspect j_security_check logs.
On September 22, 2026, CISA added a CVSS 10 input-validation flaw in Arista’s on-prem VeloCloud Orchestrator to its KEV catalog, exploitable with no credentials. Restrict network access to the VCO web interface and apply the fix before September 25.
On August 5, 2026, Cisco shipped a massive hardening release for IOS XE and SD-WAN, bundling fixes for 12 vulnerabilities uncovered during an internal AI-assisted security review. Three reach CVSS 9.9. The era of AI-accelerated vulnerability discovery has hit the network hardware industry — and Cisco just showed what that looks like in production.
The MEF published the MEF 70 standard in July 2019, Broadcom acquired VMware VeloCloud in November 2023, and FlexiWAN crossed 4,000 accounts in 2025 with open-source SD-WAN. The SD-WAN market hit $3.4 billion in 2024 and is projected to reach $13.7 billion by 2028 according to Gartner — here is why your MPLS contract is becoming a subscription to a horse-drawn carriage.
