cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Arista Patches Critical VeloCloud Orchestrator Flaw It Says Was Exploited as Zero-Day

· Original article ↗

Summary

Arista says CVE-2026-16812, a critical OS injection flaw in on-prem VeloCloud Orchestrator, is actively exploited. The remotely exploitable issue requires no credentials; Arista released patches, and CISA added it to KEV.

Key points

  • Arista reports that CVE-2026-16812, a critical OS injection vulnerability with a CVSS score of 10, is being actively exploited.
  • Only on-prem VeloCloud Orchestrator is affected; exploitation requires network access to its web interface but no authentication or special configuration.
  • Arista released fixes in VCO versions 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1.
  • CISA added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog and directed federal agencies to patch within three days.
  • Arista advises checking web access, backend application, and system logs for suspicious requests, command execution, data exports, file creation, and privileged actions.
  • If compromise is suspected, operators are advised to preserve relevant logs and filesystem timestamps before remediation where feasible.

Article Details

Vulnerability Types
  • OS injection
Severity
Critical; maximum CVSS score of 10
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationCVE-2026-16812 was actively exploited remotely through the VeloCloud Orchestrator web interface.

CVE

CVE-2022-42475assigned earlier this year to a patch bypass of exploited FortiOS SSL-VPN vulnerabilities, including CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762.CVE-2023-27997this year to a patch bypass of exploited FortiOS SSL-VPN vulnerabilities, including CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762.CVE-2024-21762bypass of exploited FortiOS SSL-VPN vulnerabilities, including CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762.CVE-2025-68686Additionally, CISA warns that hackers have been exploiting CVE-2025-68686, which Fortinet assigned earlier this year to a patch bypass of exploited FortiOS SSL-VPN vulnerabilities, including CVE-2022-42475,CVE-2026-16812The security defect is tracked as CVE-2026-16812, has a maximum CVSS score of 10, and could be exploited remotely to access privileged functionality intended for internal use only.

Vendors

Arista NetworksArista Networks on Monday released patches for a critical-severity OS injection vulnerability in the VeloCloud Orchestrator (VCO) centralized management platform, warning that it has been exploited in the wild as aFortinetAdditionally, CISA warns that hackers have been exploiting CVE-2025-68686, which Fortinet assigned earlier this year to a patch bypass of exploited FortiOS SSL-VPN vulnerabilities, including CVE-2022-42475,

Products

FortiOSbeen exploiting CVE-2025-68686, which Fortinet assigned earlier this year to a patch bypass of exploited FortiOS SSL-VPN vulnerabilities, including CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762.VeloCloud Orchestrator On-PremAccording to the company, only VeloCloud Orchestrator On-Prem (formerly VeloCloud Orchestrator by Broadcom) is affected by the bug.

Related Articles