--- id: "CVE-2026-16812" kind: "vulnerability" aliases: ["CVE-2026-16812"] title: "arista velocloud orchestrator: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access\u2026" severity: "critical" cvss: 10.0 epss: null exploited: true status: "resolved" category: "vendor" products: [{"name": "VeloCloud Orchestrator On-Prem", "fixed": ["5.2.3.14", "6.1.3.4", "6.4.2.4", "7.0.0.1"], "affected": ">= 5.2.0, < 5.2.3.14; >= 6.1.0, < 6.1.3.4; >= 6.4.0, < 6.4.2.4; >= 7.0.0, < 7.0.0.1", "ecosystem": "vendor"}, {"name": "arista velocloud orchestrator", "fixed": ["5.2.3.14"], "affected": ">= 5.2.0, < 5.2.3.14", "ecosystem": "vendor"}, {"name": "arista velocloud orchestrator", "fixed": ["6.1.3.4"], "affected": ">= 6.1.0, < 6.1.3.4", "ecosystem": "vendor"}, {"name": "arista velocloud orchestrator", "fixed": ["6.4.2.4"], "affected": ">= 6.4.0, < 6.4.2.4", "ecosystem": "vendor"}, {"name": "arista velocloud orchestrator", "fixed": [], "affected": "= 7.0.0", "ecosystem": "vendor"}, {"name": "Arista VeloCloud Orchestrator", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["arista", "exploited", "on-prem", "sd-wan", "vco", "velocloud", "vendor"] not_affected_if: ["managed-hosting", "not-on-prem-orchestrator"] published_at: "2026-07-27T00:00:00+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T00:09:50+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16812", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:42:27+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16812", "first_seen_at": "2026-10-23T23:44:51+00:00"}] --- # arista velocloud orchestrator: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access… Unauthenticated OS command injection (CWE-78, CVSS 10.0) in on-prem Arista VeloCloud Orchestrator. A remote attacker with network access to the VCO web interface reaches internal-only functionality and can run commands on the VCO host. No credentials needed. VCO is exposed by default and no setting prevents it. Actively exploited, in CISA KEV since 2026-07-27. Hosted and Dedicated VCO are being patched by Arista. A compromised VCO may give attackers access to managed Edge devices. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:VeloCloud Orchestrator On-Prem affected >= 5.2.0, < 5.2.3.14; >= 6.1.0, < 6.1.3.4; >= 6.4.0, < 6.4.2.4; >= 7.0.0, < 7.0.0.1 fixed 5.2.3.14, 6.1.3.4, 6.4.2.4, 7.0.0.1 - vendor:arista velocloud orchestrator affected >= 5.2.0, < 5.2.3.14 fixed 5.2.3.14 - vendor:arista velocloud orchestrator affected >= 6.1.0, < 6.1.3.4 fixed 6.1.3.4 - vendor:arista velocloud orchestrator affected >= 6.4.0, < 6.4.2.4 fixed 6.4.2.4 - vendor:arista velocloud orchestrator affected = 7.0.0 fixed ? - vendor:Arista VeloCloud Orchestrator affected ? fixed ? ## How to check 1) Check VCO version: affected are 5.2.x before 5.2.3.14, 6.1.x before 6.1.3.4, 6.4.x before 6.4.2.4, 7.0.x before 7.0.0.1 (end-of-support releases not assessed). 2) Review VCO web access logs for unusual URL-like path components, encoded characters, references to local/internal services, high request rates. 3) Look for requests from 8.19.75.217, 206.72.242.124, 206.72.242.162; unexpected outbound HTTP(S) from the VCO host; unexpected command execution, file creation, DB export or archives; config changes not matching admin activity. ## Fix Upgrade to a fixed VCO: 5.2.3.14+, 6.1.3.4+ or 6.4.2.4+ in the same train. 7.0 fixed build not listed in SA 0144 (7.0.0.1 is the first non-affected). Later advisory SA 0183 for sibling CVE-2026-93952 lists newer builds, so prefer the latest. Until patched, restrict the VCO web interface to trusted admin networks, block the listed IPs, monitor outbound traffic. If compromise is suspected, preserve logs first, then rotate credentials and certificates, validate managed device state and rebuild the VCO from trusted sources. Unsupported trains: contact Arista TAC. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16812 - 2026-10-23T21:42:27+00:00 analyst — Read Arista SA 0144 (rev 1.2) directly; versions, IOC IPs, mitigation from it; CVSS 10.0 unauthenticated. No PoC found; X count 0, no discussion found. Sibling CVE-2026-93952 (SA 0183) lists later fixed builds, so go to latest. - 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-16812 ## Documents - [advisory] Arista Security Advisory 0144 https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144 - [discussion] BleepingComputer: Arista patches VeloCloud Orchestrator zero-day exploited in attacks https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/ - [mentions] NVD CVE-2026-16812 https://nvd.nist.gov/vuln/detail/CVE-2026-16812 ## From the sources Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_