Full Report
A maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), is a case of operating system command injection that could pave the way for arbitrary code execution. "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue
Analysis Summary
# Vulnerability: Critical OS Command Injection in Arista VeloCloud Orchestrator
## CVE Details
- **CVE ID:** CVE-2026-16812
- **CVSS Score:** 10.0 (Critical)
- **CWE:** OS Command Injection (Technical details suggest access to privileged internal functionality)
## Affected Systems
- **Products:** Arista VeloCloud Orchestrator (VCO) On-Premises
- **Versions:**
- VCO 5.2.x releases prior to 5.2.3.14
- VCO 6.1.x releases prior to 6.1.3.4
- VCO 6.4.x releases prior to 6.4.2.4
- VCO 7.0.x releases prior to 7.0.0.1
- **Configurations:** Specifically affects on-premises deployments. Hosted and dedicated versions have already been addressed.
## Vulnerability Description
The flaw is an operating system command injection vulnerability. It exists in functionality originally intended for internal use only that was inadvertently left accessible remotely. An attacker can exploit this to access privileged internal functionality, potentially allowing for arbitrary code execution on the VCO host.
## Exploitation
- **Status:** Exploited in the wild (Added to CISA KEV catalog).
- **Complexity:** Not explicitly stated, but high-impact command injections are typically Low to Medium.
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Total (Full access to orchestrator and managed data/devices).
- **Integrity:** Total (Ability to execute arbitrary code and modify configurations).
- **Availability:** Total (Potential to disrupt orchestrator and managed VeloCloud Edge devices).
## Remediation
### Patches
Arista has released the following fixed versions for on-premises customers:
- VCO 5.2.3.14
- VCO 6.1.3.4
- VCO 6.4.2.4
- VCO 7.0.0.1
### Workarounds
If immediate patching is not possible:
- Restrict VCO web interface access to trusted administrative networks only.
- Monitor outbound network activity for unexpected connections from the VCO host.
- Review recent administrator activity for unauthorized changes.
## Detection
### Indicators of Compromise (IoCs)
Known malicious IP addresses associated with attacks:
- 8.19.75[.]217
- 206.72.242[.]124
- 206.72.242[.]162
### Detection Methods
- **Log Review:** Inspect VCO web access logs, backend application logs, system logs, and database logs.
- **Forensics:** Check relevant file-system timestamps for unauthorized modifications.
- **VeloCloud Edge Safety:** Monitor connected Edge devices for credential rotation or unexpected state changes, as VCO compromise can extend to managed devices.
## References
- Arista Security Advisory: hxxps://www.arista[.]com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144
- CISA KEV Catalog: hxxps://www.cisa[.]gov/known-exploited-vulnerabilities-catalog
- Source Article: hxxps://thehackernews[.]com/2026/07/attackers-exploit-arista-velocloud.html