Full Report
A vulnerability has been discovered in VeloCloud Orchestrator (VCO) On-Prem that could allow for remote code execution. VeloCloud Orchestrator is a centralized management platform used to configure, provision, monitor, and troubleshoot software-defined wide area networks (SD-WAN) and SASE components across enterprise edges and gateways. Successful exploitation of this vulnerability may allow a remote attacker to access privileged internal functionality, execute commands, and impact the VCO host. Depending on the privileges associated with the service account, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Services whose accounts are configured to have less rights on the system could be less impacted than those who operate with administrative user rights.
Analysis Summary
# Vulnerability: Remote Code Execution in VeloCloud Orchestrator (VCO) On-Prem
## CVE Details
- **CVE ID:** CVE-2026-16812
- **CVSS Score:** Not explicitly listed in text (Assessed as HIGH/CRITICAL based on MS-ISAC risk levels)
- **CWE:** CWE-20 (Improper Input Validation) / CWE-287 (Improper Authentication) - *Inferred from "access privileged functionality without credentials"*
## Affected Systems
- **Products:** VeloCloud Orchestrator (VCO) On-Prem
- **Versions:**
- VCO 5.2.x releases prior to 5.2.3.14
- VCO 6.1.x releases prior to 6.1.3.4
- VCO 6.4.x releases prior to 6.4.2.4
- VCO 7.0.x releases prior to 7.0.0.1
- **Configurations:** Vulnerable by default; exposure cannot be prevented via standard configuration.
## Vulnerability Description
A critical security flaw exists in the VeloCloud Orchestrator web interface. The vulnerability allows an unauthenticated remote attacker to bypass authentication mechanisms to access internal privileged functionality. Specifically, the flaw enables the execution of arbitrary commands on the VCO host system.
## Exploitation
- **Status:** **Active exploitation reported in the wild.**
- **Complexity:** Low (Credentials are not required for exploitation).
- **Attack Vector:** Network (Remote via VCO web interface).
## Impact
- **Confidentiality:** High (Ability to view and extract data).
- **Integrity:** High (Ability to install programs, change or delete data, and create new administrative accounts).
- **Availability:** High (Ability to impact VCO host stability and SD-WAN/SASE management).
## Remediation
### Patches
Arista recommends updating to the following versions or later:
- **5.2.3.14**
- **6.1.3.4**
- **6.4.2.4**
- **7.0.0.1**
### Workarounds
- **Network Segmentation:** Isolate the VCO management interface from the public internet. Use dedicated computing resources (Safeguard 12.8) that are logically or physically separated for administrative tasks.
- **Least Privilege:** Ensure service accounts operate with minimal necessary rights to reduce the impact of successful command execution.
## Detection
### Indicators of Compromise
The following IP addresses have been identified as sources of malicious activity:
- 8[.]19[.]75[.]217
- 206[.]72[.]242[.]124
- 206[.]72[.]242[.]162
### Detection Methods and Tools
- **Log Analysis:** Review VCO web interface access logs for unusual activity originating from the IPs listed above or unauthorized access to internal functional endpoints.
- **Vulnerability Scanning:** Utilize automated scanners to identify unpatched VCO instances (M1016).
- **Penetration Testing:** Conduct authenticated penetration testing to identify similar business logic vulnerabilities (Safeguard 16.13).
## References
- **Arista Security Advisory:** hxxps://www.arista[.]com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144
- **CVE Record:** hxxps://www.cve[.]org/CVERecord?id=CVE-2026-16812
- **MS-ISAC Advisory:** 2026-072