Urgent Security Alert: CVE-2026-16812 – Critical Command Injection in Arista VeloCloud Orchestrator

A critical security vulnerability, identified as CVE-2026-16812, has been discovered in on-premises deployments of the Arista VeloCloud Orchestrator (VCO). This flaw carries a maximum severity CVSS score of 10.0, signaling the highest level of risk to affected organizations. Due to evidence of active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on July 27, 2026, mandating federal agencies and strongly advising all organizations to remediate it immediately.

What is CVE-2026-16812?

CVE-2026-16812 is an OS Command Injection vulnerability (classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command). The flaw resides in the web interface of the Arista VeloCloud Orchestrator. It stems from the improper handling of user-supplied input when interacting with internal, privileged functionality that was inadvertently exposed to remote access.

Because the orchestrator is a central management component for Software-Defined Wide Area Networks (SD-WAN), it is often accessible via the public internet. This exposure enables an unauthenticated remote attacker to send specially crafted HTTP requests to the VCO, triggering the execution of arbitrary operating system commands with high privileges on the underlying host system.

Affected Systems and Versions

The vulnerability exclusively impacts on-premises deployments of the Arista VeloCloud Orchestrator. According to Arista’s security advisory, hosted and dedicated VCO instances were patched by the vendor prior to public disclosure and are not affected by this specific issue. The affected version branches for on-premises installations include:

• 5.2.x branch: All versions prior to 5.2.3.14
• 6.1.x branch: All versions prior to 6.1.3.4
• 6.4.x branch: All versions prior to 6.4.2.4
• 7.0.x branch: All versions prior to 7.0.0.1

SeverityRating and Potential Impact

The CVSS v3.1 score of 10.0 reflects the extreme critical nature of this flaw. The impact of a successful exploitation is severe and multifaceted:

• Full System Compromise: Attackers can gain complete control over the orchestrator host, allowing for the deployment of persistent backdoors, web shells, or ransomware.
• Data Exfiltration: Sensitive SD-WAN configuration data, network topologies, and management credentials can be accessed and stolen.
• Lateral Movement: As the central management hub, a compromised VCO can be used as a pivot point to move laterally into managed VeloCloud Edge devices and deeper into the internal corporate network.
• Unauthenticated Access: The exploitation requires no prior authentication, credentials, or user interaction, making it highly attractive to automated scanning and mass exploitation by threat actors.

Evidence of Active Exploitation

Security researchers and Arista have confirmed that threat actors are actively leveraging CVE-2026-16812 in targeted attacks. Analysts have identified several malicious IP addresses associated with these campaigns, including 8.19.75.217, 206.72.242.124, and 206.72.242.162. The rapid addition to CISA’s KEV catalog underscores that this is not just a theoretical threat but a clear and present danger to infrastructure security.

Mitigation and Remediation Steps

The primary and most effective remediation is to apply the security patches released by Arista immediately. Organizations should upgrade to the following fixed versions based on their current deployment branch:

• Branch 5.2.x: Upgrade to 5.2.3.14 or later.
• Branch 6.1.x: Upgrade to 6.1.3.4 or later.
• Branch 6.4.x: Upgrade to 6.4.2.4 or later.
• Branch 7.0.x: Upgrade to 7.0.0.1 or later.

If immediate patching is not possible, the following temporary mitigations should be implemented to reduce risk:

• Restrict Web Access: Limit access to the VCO web interface to trusted administrative IP ranges or require a VPN for access.
• Network Isolation: Ensure the VCO is not directly exposed to the public internet whenever possible.
• Enhanced Monitoring: Audit web server logs and system logs for suspicious HTTP requests, unexpected outbound network connections, or unauthorized administrative actions.
• Indicators of Compromise (IoC): Block the known malicious IP addresses mentioned above at the network perimeter.

If you suspect your system has already been compromised, it is vital to perform a thorough forensic investigation before applying patches. Preserving logs and file-system timestamps is critical for determining the scope of the breach. Post-remediation, it is recommended to rotate all service and administrative credentials associated with the orchestrator.

Stay vigilant and prioritize this patch to protect your SD-WAN infrastructure from active exploitation.