A critical, unpatched CVSS 10.0 command injection flaw in VeloCloud Orchestrator is being actively exploited, requiring immediate upgrade to fixed versions and comprehensive incident response measures.