Critical Arista VeloCloud Orchestrator flaw exploited in attacks

Arista patched a critical vulnerability in on-premises VeloCloud Orchestrator, the console that configures and manages VeloCloud SD-WAN deployments, that is already being exploited. Tracked as CVE-2026-16812 and scored 10.0, it is an unauthenticated operating-system command injection that lets a remote attacker reach privileged functionality meant only for internal use. Arista warns successful exploitation can compromise the confidentiality, integrity, and availability of the orchestrator and everything it manages. There is no configuration that prevents exposure, since the web interface is reachable by default. CISA added it to its exploited-vulnerabilities catalog. Hosted and Dedicated deployments were fixed before the advisory and are not affected.

Check

Identify on-premises VeloCloud Orchestrator instances, upgrade to the fixed 5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.x releases immediately, and restrict the web interface to trusted administrative networks.

Affected

Organizations running on-premises VeloCloud Orchestrator (CVE-2026-16812); the web interface is exposed by default, needs no credentials, and active exploitation gives attackers command execution over the orchestrator and managed devices.

Fix

Upgrade to the fixed VCO versions, limit web interface access to trusted networks, and review VCO web access logs for unusual path components, encoded characters, or high request rates.