---
id: "CVE-2018-6961"
kind: "vulnerability"
aliases: ["CVE-2018-6961"]
title: "VMware SD-WAN Edge: VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability"
severity: "critical"
cvss: 8.1
epss: 0.85342
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "VMware SD-WAN Edge", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "network-appliance", "sd-wan", "velocloud", "vmware"]
not_affected_if: ["not-using-sd-wan-edge"]
published_at: "2018-06-11T22:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-6961", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-6961", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6961", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# VMware SD-WAN Edge: VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability

VMware SD-WAN Edge (VeloCloud) has a command injection flaw in its local web UI. An attacker who can reach the UI can inject operating system commands and run code on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VMware SD-WAN Edge affected ? fixed ?

## Fix

Apply the vendor updates per VMware instructions; the fixed version is unknown from the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-6961
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-6961
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-6961

## From the sources

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_