CVE-2026-16812

Published Jul 27, 2026

Last updated 7 hours ago

VeloCloud Orchestrator

VCO

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-16812 is an OS command injection vulnerability found in Arista Networks VeloCloud Orchestrator (VCO) On-Prem. This flaw allows a remote attacker to execute operating system commands on the VCO host. The vulnerable functionality was originally intended for internal use only but remained remotely accessible. Successful exploitation of CVE-2026-16812 can lead to a compromise of the confidentiality, integrity, and availability of the orchestrator and the data it manages. This vulnerability does not require authentication for exploitation and has been actively exploited in the wild.

Description: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.
Source: psirt@arista.com
NVD status: Analyzed
Products: velocloud_orchestrator

Risk scores

CVSS 4.0

Type: Secondary
Base score: 10
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
Exploit added on: Jul 27, 2026
Exploit action due: Jul 30, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

psirt@arista.com: CWE-78

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 15

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F93AF860-FDF1-4061-813C-364DA582B642",
            "versionEndExcluding": "5.2.3.14",
            "versionStartIncluding": "5.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "AD5222D5-45E4-43F9-852C-898D26F8FCDF",
            "versionEndExcluding": "6.1.3.4",
            "versionStartIncluding": "6.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C099915D-2F35-4A87-8154-82985B5DA811",
            "versionEndExcluding": "6.4.2.4",
            "versionStartIncluding": "6.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:arista:velocloud_orchestrator:7.0.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "40BC6B76-2FB0-4D62-9F46-B36A863BDCE9",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.