Arista Networks has disclosed a critical security vulnerability, identified as CVE-2026-16812, affecting its on-premises VeloCloud Orchestrator (VCO) deployments. This flaw, an operating system command injection, has been actively exploited in the wild, prompting immediate action from organizations utilizing this platform.
The VeloCloud Orchestrator serves as a centralized management system for VeloCloud SD-WAN deployments, facilitating the configuration, monitoring, and management of associated edge devices. The identified vulnerability allows unauthenticated remote attackers to execute arbitrary commands on the underlying operating system, potentially compromising the confidentiality, integrity, and availability of the orchestrator and the data it manages.
Arista has released patches to address this issue in the following VCO versions: 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1. Organizations are strongly advised to upgrade to these versions promptly to mitigate the risk of exploitation. Notably, VeloCloud Orchestrator Hosted and Dedicated deployments were patched prior to the public disclosure and are not affected by this vulnerability. Additionally, VeloCloud Gateway and VeloCloud Edge products remain unaffected.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog, underscoring the severity of the issue. Federal agencies have been directed to apply the necessary patches by July 30, 2026, in accordance with Binding Operational Directive 22-01.
Administrators are advised to monitor VCO web access logs for unusual activity, such as unexpected URL paths or requests from known malicious IP addresses. Reviewing backend application and system logs for signs of unauthorized actions, including command execution, database exports, or access to sensitive information, is also recommended. If compromise is suspected, preserving relevant logs and system data before remediation is crucial for forensic analysis.
This incident highlights the critical importance of timely vulnerability management and the need for organizations to maintain robust monitoring and incident response capabilities. As cyber threats continue to evolve, staying vigilant and proactive in applying security updates is essential to safeguard infrastructure and sensitive data.
