Unattributed · actively exploited as a zero-day, confirmed by the vendor (Arista Security Advisory 0144)critical
Ten out of ten on the orchestrator: Arista's VeloCloud flaw exploited as a zero-day
CVE-2026-16812 is a vulnerability in VeloCloud Orchestrator (VCO) On-Prem — the console that manages Arista's SD-WAN networks — with a CVSS score of 10.0, the maximum. It is an OS command injection (CWE-78) that lets a remote, unauthenticated attacker who can merely reach the web interface access privileged internal functionality and compromise the orchestrator host and the data it manages. Arista published it on 27 July 2026 in Security Advisory 0144, stating it was discovered externally and is already actively exploited; CISA added it to the Known Exploited Vulnerabilities catalog the same day. VCO is exposed by default and no configuration prevents the exposure: the only real answer is the patch.
The orchestrator is the wrong place to have a flaw
VeloCloud Orchestrator is the control room of an SD-WAN network: from there you configure, monitor and manage the sites, the edges and the traffic rules of an entire organisation. Whoever controls the orchestrator does not control just any server, they control the network that server governs. It is exactly the place where a vulnerability hurts most, and that is where CVE-2026-16812 lives: a CVSS 10.0 score, the ceiling of the scale, in both the 3.1 and the 4.0 versions.
Arista disclosed it on 27 July 2026 in Security Advisory 0144, revision 1.0. The language leaves no room: the flaw was discovered externally and is known to be actively exploited. In other words, this is not a bug found in a lab and patched out of caution — it is a zero-day someone was already using when the patch arrived. The Hosted and Dedicated versions of VCO, run by Arista, had already been fixed before the announcement; the problem is with On-Prem installations, the ones each organisation runs itself.
Where the flaw sits
The classification is CWE-78, OS command injection: the failure to neutralise the special characters used in a system command. In practice there is a piece of functionality that was meant to stay internal and not be remotely reachable, and that is instead exposed. An attacker who reaches the VCO web interface can access that privileged functionality and drive commands to the host that they should not be able to run. The CVSS vector says it compactly: AV:N/AC:L/PR:N/UI:N — network attack, low complexity, no privileges required, no user interaction — with full impact on confidentiality, integrity and availability, and a scope change.
- 01Request to the VCO web interfaceno tenant or operator credentials
- 02Exposed internal functionalityit was meant for internal use only
- 03OS command injection (CWE-78)commands run on the orchestrator host
The detail that makes the flaw hard to mitigate without a patch is in the advisory, verbatim: VCO is exposed by default, and no configuration can prevent the exposure. Exploitation requires only network access to the web interface; no tenant or operator credentials are needed. Restricting web-interface access to trusted administrative networks reduces the risk, but it does not close the hole: it is a barrier in front of the door, not the lock.
What is affected and what is already fixed
Arista lists the versions precisely. Vulnerable are VCO releases 5.2.x before 5.2.3.14, 6.1.x before 6.1.3.4, 6.4.x before 6.4.2.4 and 7.0.x before 7.0.0.1. The fixes are in builds 5.2.3.14, 6.1.3.4, 6.4.2.4 and later in their respective trains. The operational priority is blunt: upgrade to a fixed release as soon as possible, prioritising any VCO reachable over the network.
Indicators and remediation
There is no single definitive indicator of compromise, Arista warns. The advisory does say where to look: VCO web access logs, for unusual path components in URLs, encoded characters, references to local or internal services, or abnormal request spikes; and the backend application and system logs around the same timestamps. Also treat as suspicious unexpected outbound traffic from the VCO host, sensitive configuration changes that do not match administrator activity, and unexpected command execution or database exports. Arista publishes three IP addresses observed conducting the attacks, to block and hunt for in logs: 8.19.75.217, 206.72.242.124, 206.72.242.162.
One point the advisory stresses, worth repeating: compromise of the orchestrator can also open access to the VeloCloud Edge devices it manages. So where an intrusion is suspected, remediation does not end with the patch: credential rotation, review of administrator activity, validation of managed-device state and, if needed, restoration of the orchestrator from a trusted source.
As always, we describe the mechanics conceptually — exposed internal functionality, command injection, execution on the host — and do not publish the request used to exploit the flaw: the logic of the dossier is to help you defend. The facts that matter — CVSS 10.0, active exploitation, versions and fixes, indicators — are verifiable at the sources at the top of the page: Arista's advisory for the technical description and the CISA catalog for confirmation of exploitation. The MITRE IDs we report, T1190 and T1059, are our reasoned mapping of the behaviours described: the advisory provides no ATT&CK IDs, and we say so.
