CVE-2026-16812: Arista VeloCloud Orchestrator CVSS 10.0 Command Injection Exploited in the Wild

Arista VeloCloud Orchestrator on-prem versions contain an unauthenticated OS command injection flaw, CVE-2026-16812, scored CVSS 10.0. Attackers can fully control the SD-WAN management plane and all edge devices; CISA added it to the KEV catalog.

Incident Overview

On 27 July 2026, Arista Networks published Security Advisory 0144 confirming an OS command injection in on-prem VeloCloud Orchestrator (VCO), CVE-2026-16812, CVSS v3.1 10.0 (Critical). A remote unauthenticated attacker can reach a privileged function meant for internal use and execute arbitrary OS commands on the VCO host. Arista states the product is network-exposed by default; no configuration removes that exposure.

CISA added the flaw to the Known Exploited Vulnerabilities (KEV) catalog the same day and requires federal agencies to patch by 10 August. Arista observed active exploitation and published three attacker IPs for operators to hunt: `8.19.75.217`, `206.72.242.124`, and `206.72.242.162`.

Technical Details

Vulnerability Basics

CVE ID CVE-2026-16812

CVSS v3.1 10.0 (Critical, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Type CWE-78: OS Command Injection

Attack vector Network, unauthenticated, no user interaction

Affected component VeloCloud Orchestrator On-Prem

Root Cause

The flaw lives in a high-privilege VCO function intended for internal use only. That function is exposed by default on a web UI endpoint. No credentials required: crafted input to the VCO host triggers OS command execution and runs arbitrary code at high privilege on the host.

After successful exploitation, an attacker can:

• Fully control the SD-WAN management plane, including policy, device registration, and traffic monitoring

• Push malicious configs via VCO to all downstream VeloCloud Edge branch devices

• Steal device credentials, certificates, and network topology stored on VCO

• Tamper with SD-WAN routing policy and hijack encrypted traffic between enterprise branches

• Pivot from VCO into the enterprise intranet for lateral movement

Related Fixes in the Same Advisory

Arista also patched two other VCO flaws in the same advisory:

• CVE-2026-17191: SQL injection leading to SSRF, CVSS 9.1 (authenticated)

• CVE-2026-17192: standalone SSRF, CVSS 8.5 (authenticated)

Neither has been seen in malicious use yet. Include both in the same patch window.

Impact Assessment

VeloCloud Orchestrator is the core management component of Arista SD-WAN. It holds network policy and traffic scheduling for every branch and data center. Impact far exceeds a single-host compromise:

• Default exposure: no misconfig required; VCO is already reachable

• Management-plane loss: one bug hands the attacker the entire SD-WAN fabric

• Active exploitation: KEV listing means real attackers have weaponized it

• Public IoCs: three attacker IPs for immediate log hunts and firewall blocks

• IR cascade: Arista advises credential rotation, admin activity review, and managed-device state verification

Remediation

Patch Immediately

Arista shipped patches for on-prem VCO. Upgrade now:

| Affected branch | Fixed version | | --- | --- | | 5.2.x | 5.2.3.14 or later | | 6.1.x | 6.1.3.4 or later | | 6.4.x | 6.4.2.4 or later | | 7.0.x | 7.0.0.1 or later |

Customers on Arista Hosted or Dedicated VCO cloud services need take no action. Arista patched those before the advisory.

Temporary Mitigations

• Network isolation: restrict the VCO web management UI to a trusted management network; block direct internet access

• Block IoCs: block the three published attacker IPs at the perimeter firewall (8.19.75.217, 206.72.242.124, 206.72.242.162)

• Review logs: inspect VCO web access logs and backend system logs for anomalous requests, unknown source IPs, and suspicious command-execution records

• Rotate credentials: rotate credentials for all Edge devices, certificates, and admin accounts

• Verify device state: check config integrity on all managed VeloCloud Edge devices; flag unauthorized policy changes

Defense in Depth

• Treat the network management plane as a critical asset under zero trust

• Enforce MFA and restrict source IPs that can reach the VCO management interface

• Audit and alert on SD-WAN device config changes

• Review vendor advisories regularly; fold emergency patches for critical infrastructure products into a fast-response process

References

• Arista Security Advisory 0144: VeloCloud Orchestrator Command Injection

• CISA: Known Exploited Vulnerabilities Catalog (KEV)

• The Hacker News: Arista VeloCloud Zero-Day Exploited

• BleepingComputer: Arista Patches Actively Exploited VeloCloud Flaw

• Anheng Information: In-Depth Analysis of CVE-2026-16812 VCO Command Injection