Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day
Summary
Arista patched CVE-2026-16812, a maximum-severity unauthenticated command injection flaw in on-premises VeloCloud Orchestrator. The flaw is actively exploited; affected organizations are urged to update and review systems for compromise.
Key points
- CVE-2026-16812 is an unauthenticated OS command injection flaw rated 10.0 that affects on-premises VeloCloud Orchestrator deployments.
- Arista says attackers need network access to the VCO web interface but no tenant or operator credentials; the company has not disclosed who is exploiting the flaw or how.
- Affected releases are VCO 5.2.x before 5.2.3.14, 6.1.x before 6.1.3.4, 6.4.x before 6.4.2.4, and 7.0.x before 7.0.0.1.
- Arista says hosted and dedicated deployments were patched before its advisory; VeloCloud Gateway and Edge products are not vulnerable to this flaw.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. Arista shared three IP addresses associated with exploitation: 8.19.75.217, 206.72.242.124, and 206.72.242.162.
- Arista advises restricting VCO web access, blocking the listed IPs, reviewing logs and administrator activity, and investigating possible compromise; patching alone may not be sufficient for breached systems.
Article Details
- Vulnerability Types
- Unauthenticated OS command injection
- Severity
- Maximum severity; score 10.0
- Affected Versions
- VeloCloud Orchestrator 5.2.x releases before 5.2.3.14
- VeloCloud Orchestrator 6.1.x releases before 6.1.3.4
- VeloCloud Orchestrator 6.4.x releases before 6.4.2.4
- VeloCloud Orchestrator 7.0.x releases before 7.0.0.1
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict access to the VCO web interface to administrative networks.
- Block the listed IP addresses while patches are being deployed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 206[.]72[.]242[.]124 | Arista identified this IP address among those seen exploiting the vulnerability. |
| IPV4 | 206[.]72[.]242[.]162 | Arista identified this IP address among those seen exploiting the vulnerability. |
| IPV4 | 8[.]19[.]75[.]217 | Arista identified this IP address among those seen exploiting the vulnerability. |
MITRE ATT&CK
CVE
Vendors
Products
Arista VeloCloud OrchestratorArista has patched CVE-2026-16812, a maximum-severity unauthenticated OS command injection flaw in on-premises VeloCloud Orchestrator that is being actively exploited.VeloCloud EdgeThe issue can expose VCO hosts and managed data, and compromised orchestrators may also put VeloCloud Edge devices at risk.