CVE-2026-16812

Arista VeloCloud Orchestrator (VCO) On-Prem, the centralized management platform for VeloCloud SD-WAN networks, contains an OS command injection vulnerability (CWE-78) that allows a remote attacker to execute operating system commands, reach privileged internal functionality, and impact the underlying VCO host. The available advisory text does not describe the exact injection point or authentication requirements, but the flaw is exploitable remotely against the on-premises orchestrator. A successful attack can compromise the confidentiality, integrity, and availability of the orchestrator and of the configuration and network data it manages. Organizations running an on-premises VeloCloud Orchestrator are affected; CISA scopes the flaw to the on-prem product, provides no version ranges in this data, and no CVSS score has been published yet. The flaw was added to CISA's KEV on 2026-07-27, confirming exploitation in the wild, while ransomware use is unknown, no public proof-of-concept is available, and EPSS currently puts 30-day exploitation probability at 1.6% (74th percentile).

What to do: Follow Arista's VeloCloud security advisory: match your on-prem VCO release against the advisory's affected list and apply the fixed update as soon as possible, as required for U.S. federal agencies under BOD 26-04 by the CISA deadline. Until patched, restrict the orchestrator's web/API access to trusted management networks or VPN, verify whether your VCO is internet-exposed, and hunt for signs of unexpected command execution or privileged activity on the VCO host per CISA's forensics triage requirements; if mitigations are unavailable, follow BOD 26-04 guidance on discontinuing use of the product.