Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-68686 | Unauthenticated Info-Exposure Bypass of Symlink Patch in Fortinet FortiOS | 5.9 | 29% | KEV | KEV |
| CVE-2026-16723 | A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83 | 9.0 | <1% | PoC ×3 | |
| CVE-2026-16812 | OS Command Injection in Arista VeloCloud Orchestrator On-Prem | 10.0 | 2% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 206.72.242.124 | iew the logs to determine if they are present - 8.19.75.217 206.72.242.124 206.72.242.162 "If compromise is suspected, operators shoul |
| ipv4 | 206.72.242.162 | determine if they are present - 8.19.75.217 206.72.242.124 206.72.242.162 "If compromise is suspected, operators should preserve VCO |
| ipv4 | 8.19.75.217 | them and review the logs to determine if they are present - 8.19.75.217 206.72.242.124 206.72.242.162 "If compromise is suspected, |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Jul 28, 2026 Vulnerability / Threat Intelligence A maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-16812 (CVSS score: 10. 0), is a case of operating system command injection that could pave the way for arbitrary code execution.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.