Hackers have been exploiting a critical OS injection vulnerability in Arista VeloCloud Orchestrator as a zero-day.