CVE-2026-16812criticalunder attackCWE-78

CVE-2026-16812: critical vulnerability in Arista Networks VeloCloud Orchestrator On-Prem

VeloCloud Orchestrator OS Command Injection

Published · Updated

Follow this CVE+ Monitor VeloCloud Orchestrator On-Prem+ Monitor VeloCloud Orchestrator

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

58Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has an official Brazilian government alert.

ssvc Actcvss 10epss 1.8%
from disclosure to weapon
Published on NVDJul 27
CISA KEVJul 27
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2026-07-30

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

VeloCloud Orchestrator on-premises contains a command injection vulnerability that lets remote attackers execute arbitrary system commands with high privileges. This can completely compromise the orchestrator and all data it manages.

Technical detail

OS command injection vulnerability (CWE-78) in VeloCloud Orchestrator on-premises allows unauthenticated remote attackers to execute arbitrary commands with elevated privileges through improperly validated input in internal-only functionality exposed to the network. Exploitation directly impacts confidentiality, integrity, and availability of the orchestrator host and all managed infrastructure.

Summary generated and translated by AI from the official description.
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P
Affected products
Arista Networks · VeloCloud Orchestrator On-Prem
Related CVEs — Arista Networks VeloCloud Orchestrator On-Prem

In the same product, most dangerous first.

CVE-2026-17191HIGHVeloCloud Orchestrator Flow Metrics API SQL InjectionEPSS 0.4%CVE-2026-17192MEDIUMVeloCloud Orchestrator Missing Input Validation SSRFEPSS 0.3%