CVE-2018-6961VulnerabilityPublished 03/25/2022Updated 10/24/2026

CVE-2018-6961: VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability

Affects VMware SD-WAN EdgeSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/25/2022
KEV deadline: 04/15/2022
EPSS: 85.3% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2018-6961 (opens in a new tab)

Description

VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in its local web UI component. Exploiting this vulnerability can lead to remote code execution on the affected device. This vulnerability has been observed to be exploited in the wild. No specific affected versions or patch information is provided.

Summary

CVE-2018-6961 is a command injection vulnerability in the local web UI of VMware SD-WAN Edge by VeloCloud. Successful exploitation allows an attacker to execute arbitrary commands remotely, potentially compromising the device. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). It has been reported as actively exploited in the wild. No vendor advisory or patch details are included in the provided data.

Impact

Exploitation of this vulnerability can result in remote code execution on VMware SD-WAN Edge devices, potentially allowing attackers to take control of the device and execute arbitrary commands. This poses a high risk to the confidentiality, integrity, and availability of the affected systems.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the local web UI component to trusted administrators only and monitor for suspicious activity related to this vulnerability.

Weaknesses

CWE-78OS Command Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:57:17 UTC

Weaknesses

References

Related threats