Is CVE-2018-6961 (VMware SD-WAN Edge by VeloCloud Command Injection) being exploited in the wild?

Yes. CISA added CVE-2018-6961 to its Known Exploited Vulnerabilities catalogue on 25 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Any organisation running the affected product should treat remediation as urgent.

What it means for a CVE to be exploited in the wild

The practical question is not just whether a vulnerability exists, but whether attackers are already using it against real systems. For this case, the important distinction is that the issue has crossed from theoretical exposure into active exploitation, which makes asset confirmation, compensating controls, and exposure reduction more urgent than a normal vulnerability review.

That matters because edge devices and web-facing management components are often reachable from high-trust network paths. When a command injection flaw exists in that kind of surface, the security problem is usually less about the abstract bug class and more about how quickly an attacker can turn it into command execution, persistence, or a foothold for later movement.

How to assess exposure and immediate response

Start by confirming whether the affected product is present anywhere in your environment, including branch offices, remote sites, lab networks, and inherited infrastructure. For internet-exposed or remotely managed appliances, treat the question of exposure as urgent even if you have not seen obvious alerts, because active exploitation often begins before telemetry catches up.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog for authoritative remediation guidance, and validate inventory against your own asset records rather than assuming the device count is complete. If the affected surface is part of a broader perimeter stack, include backup units, cold spares, and test devices in scope.

What the vulnerability class implies for defenders

Command injection on a local web UI is a high-value failure mode because it can turn a management interface into an execution path. Even when the interface is intended for administrative use, it can become the pivot point for changing configuration, harvesting local secrets, modifying routing or security settings, or establishing durable access if the device is reachable and unprotected.

For that reason, responders should assume the risk is not limited to the initial bug. Once an attacker can issue commands on an edge device, the likely security questions expand to what local accounts, secrets, sessions, logs, and neighbouring management systems were reachable from that device at the time of compromise.

Risk and Threat Considerations

This is a material exploitation risk because actively targeted edge devices are often deployed in locations where they concentrate connectivity and management trust. If an attacker gains command execution on the appliance, they may be able to tamper with traffic handling, reach internal services, or use the device as a stable access point while blending in with legitimate administration.

Failure mechanism: An attacker exploits the command injection path in the web UI to execute operating-system commands on the appliance, then uses that foothold to alter configuration, harvest credentials or tokens, or establish persistence before defenders notice abnormal behaviour.

Impact: The result can include loss of management integrity, service disruption, unauthorized access to adjacent systems, and a wider compromise path if the device sits at a network boundary or handles trusted administrative traffic.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes vulnerability prioritisation central to this case.
Recommendation — Prioritise and remediate the exposed device immediately using continuous vulnerability management.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE requires timely remediation and verification of vulnerable assets.
	AU-6 — Audit Record Review, Analysis, and Reporting	Post-exploitation validation depends on reviewing appliance logs and anomalies.
Recommendation — Apply flaw remediation processes to identify, patch, and verify affected appliances. Review audit records for signs of command execution, tampering, or unauthorized changes.
ISO/IEC 27001:2022	A.8.8 — Management of Technical Vulnerabilities	The issue is an exploited technical vulnerability requiring urgent treatment.
Recommendation — Track, prioritise, and remediate the vulnerability through formal vulnerability management.

Practitioner Guidance

What to prioritise: Treat confirmed or suspected exposure as an emergency remediation item, not a routine patch queue entry. If immediate patching is not possible, reduce exposure first by restricting management access, isolating the device, and tightening administrative paths to the smallest possible set.

What to verify: Check for signs of pre-patch compromise before and after remediation, including unexpected administrative changes, unusual child processes, unexplained outbound connections, modified configuration, and log gaps that suggest tampering or log clearing. If the device supports it, preserve forensic evidence before rebooting or replacing it.

Practitioner takeaway: For an exploited edge-device CVE, the remediation decision is only half the job, because you also need to decide whether the appliance should be treated as a suspected compromise until its state has been validated.