{"id":"CVE-2026-16812","kind":"vulnerability","aliases":["CVE-2026-16812"],"related":[],"title":"arista velocloud orchestrator: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access…","description":"Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Unauthenticated OS command injection (CWE-78, CVSS 10.0) in on-prem Arista VeloCloud Orchestrator. A remote attacker with network access to the VCO web interface reaches internal-only functionality and can run commands on the VCO host. No credentials needed. VCO is exposed by default and no setting prevents it. Actively exploited, in CISA KEV since 2026-07-27. Hosted and Dedicated VCO are being patched by Arista. A compromised VCO may give attackers access to managed Edge devices.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-07-27T00:00:00+00:00","products":[{"name":"VeloCloud Orchestrator On-Prem","fixed":["5.2.3.14","6.1.3.4","6.4.2.4","7.0.0.1"],"affected":">= 5.2.0, < 5.2.3.14; >= 6.1.0, < 6.1.3.4; >= 6.4.0, < 6.4.2.4; >= 7.0.0, < 7.0.0.1","ecosystem":"vendor"},{"name":"arista velocloud orchestrator","fixed":["5.2.3.14"],"affected":">= 5.2.0, < 5.2.3.14","ecosystem":"vendor"},{"name":"arista velocloud orchestrator","fixed":["6.1.3.4"],"affected":">= 6.1.0, < 6.1.3.4","ecosystem":"vendor"},{"name":"arista velocloud orchestrator","fixed":["6.4.2.4"],"affected":">= 6.4.0, < 6.4.2.4","ecosystem":"vendor"},{"name":"arista velocloud orchestrator","fixed":[],"affected":"= 7.0.0","ecosystem":"vendor"},{"name":"Arista VeloCloud Orchestrator","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["arista","exploited","on-prem","sd-wan","vco","velocloud","vendor"],"not_affected_if":["managed-hosting","not-on-prem-orchestrator"],"how_to_check":"1) Check VCO version: affected are 5.2.x before 5.2.3.14, 6.1.x before 6.1.3.4, 6.4.x before 6.4.2.4, 7.0.x before 7.0.0.1 (end-of-support releases not assessed). 2) Review VCO web access logs for unusual URL-like path components, encoded characters, references to local/internal services, high request rates. 3) Look for requests from 8.19.75.217, 206.72.242.124, 206.72.242.162; unexpected outbound HTTP(S) from the VCO host; unexpected command execution, file creation, DB export or archives; config changes not matching admin activity.","fix":"Upgrade to a fixed VCO: 5.2.3.14+, 6.1.3.4+ or 6.4.2.4+ in the same train. 7.0 fixed build not listed in SA 0144 (7.0.0.1 is the first non-affected). Later advisory SA 0183 for sibling CVE-2026-93952 lists newer builds, so prefer the latest. Until patched, restrict the VCO web interface to trusted admin networks, block the listed IPs, monitor outbound traffic. If compromise is suspected, preserve logs first, then rotate credentials and certificates, validate managed device state and rebuild the VCO from trusted sources. Unsupported trains: contact Arista TAC.","status":"resolved","published_at":"2026-07-27T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:33+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-23T20:33:33Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations and patch from Arista's vendor advisory per CISA's required action; if no mitigation exists, discontinue use of the product as CISA directs. Affected and fixed versions: unknown.","summary":"Arista VeloCloud Orchestrator On-Prem has an OS command injection flaw that lets a remote attacker reach privileged internal functionality on the VCO host. Successful exploitation can compromise confidentiality, integrity and availability of the orchestrator and the data it manages, and CISA lists it as actively exploited.","category":"vendor","who_cares":["arista","velocloud","vco","on-prem"],"confidence":0.6,"analyst_note":"Find Arista's advisory for CVE-2026-16812 to get affected and fixed versions and mitigation steps; check the CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16812.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","not-on-prem-orchestrator"],"severity_if_unknown":"high"},"cost_usd":0.000425,"input_tokens":2270,"output_tokens":397,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find Arista's advisory for CVE-2026-16812 to get affected and fixed versions and mitigation steps; check the CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16812.","search":"'-04':205C,231C,262C '-07':120B '-16812':26A,29A '-2026':25A,28A '-27':121B '-78':66B '10.0':68B '2026':119B '26':204C,230C,261C 'access':23A,81B,137B,161C 'accord':194C 'action':190C 'activ':113B 'adher':258C 'allow':18A,156C 'appli':191C 'applic':228C 'arista':1A,35A,38A,41A,44A,47A,50B,73B,130B,142C 'asset':252C 'attack':21A,78B,136B,159C 'avail':178C 'base':209C 'bod':203C,229C,260C 'cisa':116B,188C,201C,218C 'cloud':234C 'command':63B,95B,151C 'complianc':199C 'compromis':132B,173C 'confidenti':175C 'contain':148C 'credenti':101B 'cve':24A,27A 'cvss':67B 'cwe':65B 'data':183C 'dedic':124B 'default':107B 'devic':141B 'discontinu':237C 'edg':140B 'ensur':198C,257C 'evalu':250C 'exploit':51B,114B,171C 'expos':105B 'exposur':255C 'follow':227C 'forens':220C 'function':91B,164C 'give':135B 'guidanc':216C,232C 'guidelin':264C 'host':99B,122B,169C 'impact':166C 'inject':64B,152C 'instruct':197C 'integr':176C 'interfac':86B 'intern':89B,163C 'internal-on':88B 'internet':254C 'issu':13A,16A 'kev':117B 'manag':139B,184C 'may':17A,134B,155C,172C 'mitig':192C,243C 'need':102B 'network':80B 'note':215C,226C 'on':33A 'on-prem':7A,32A,52B,70B,145C 'orchestr':3A,5A,75B,144C,181C,187C 'orchestrator':31A,37A,40A,43A,46A,49A 'os':62B,150C 'patch':128B,263C 'prem':9A,34A,54B,72B,147C 'prevent':111B 'priorit':206C 'privileg':162C 'product':241C 'reach':87B 'remot':20A,77B,158C 'requir':189C,222C 'respons':248C 'risk':211C 'run':94B 'sd':56B 'sd-wan':55B 'secur':12A,207C 'see':212C,223C 'servic':235C 'set':110B 'sinc':118B 'stakehold':246C 'success':170C 'triag':221C 'unauthent':61B 'unavail':245C 'updat':208C 'url':213C,224C 'use':238C 'vco':6A,58B,84B,98B,103B,125B,133B,168C 'velocloud':2A,4A,30A,36A,39A,42A,45A,48A,59B,74B,143C 'vendor':60B,196C 'vulner':153C 'wan':57B 'web':85B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-27T00:00:00+00:00","kev":{"dateAdded":"2026-07-27","dueDate":"2026-07-30","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-16812","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16812","severity":null,"published_at":"2026-07-27T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-16812:136","url":null,"severity":null,"published_at":"2026-10-23T21:42:27+00:00","modified_at":"2026-10-23T21:42:27+00:00","first_seen_at":"2026-10-23T21:42:27+00:00","fetched_at":"2026-10-23T21:42:27+00:00","note":"Read Arista SA 0144 (rev 1.2) directly; versions, IOC IPs, mitigation from it; CVSS 10.0 unauthenticated. No PoC found; X count 0, no discussion found. Sibling CVE-2026-93952 (SA 0183) lists later fixed builds, so go to latest."},{"source":"nvd","external_id":"CVE-2026-16812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16812","severity":null,"published_at":"2026-07-27T16:17:03+00:00","modified_at":"2026-07-28T14:50:33+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[{"id":1207,"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144","title":"Arista Security Advisory 0144","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1208,"url":"https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/","title":"BleepingComputer: Arista patches VeloCloud Orchestrator zero-day exploited in attacks","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":1209,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16812","title":"NVD CVE-2026-16812","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}