← back
CVE-2026-16812criticalunder attackCWE-78

VeloCloud Orchestrator OS Command Injection

58Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 10epss 0.9%
from disclosure to weapon
Published on NVDJul 27
CISA KEVJul 27
exploitation probability
0.9%top 44% of all CVEs
observed exploitation
yesCISA + VulnCheck
Action required by CISAfederal deadline: 2026-07-30

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

VeloCloud Orchestrator on-premises contains a command injection vulnerability that lets remote attackers execute arbitrary system commands with high privileges. This can completely compromise the orchestrator and all data it manages.

Technical detail

OS command injection vulnerability (CWE-78) in VeloCloud Orchestrator on-premises allows unauthenticated remote attackers to execute arbitrary commands with elevated privileges through improperly validated input in internal-only functionality exposed to the network. Exploitation directly impacts confidentiality, integrity, and availability of the orchestrator host and all managed infrastructure.

Summary generated and translated by AI from the official description.
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P
Affected products
Arista Networks · VeloCloud Orchestrator On-Prem
References
https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812