CVE-2026-16812
CRITICAL 10 KNOWN EXPLOITED ALL-YEARSVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.
Confirmed exploited in the wild — in CISA KEV since 2026-07-27. Patch or mitigate now.
Exploitation likelihood
1.0%chance of exploitation in 30 days · 63rd percentile
Impact if exploited
10CVSS 4.0 · CRITICAL · CNA
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Affected
Vendors Arista Networks Arista
Products Velocloud Orchestrator On Prem Velocloud Orchestrator
Weakness (CWE)
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P
References and research data (JSON)
Additional exploitation reports
Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.
- VulnCheck KEV · 2026-07-27T00:00:00Z
Source guidance: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source ransomware assessment: Unknown
VulnCheck KEV · CVE-2026-16812 · Updated 2026-07-27T00:00:00Z - VulnCheck KEV · 2026-07-27T00:00:00ZVulnCheck KEV · CVE-2026-16812
VulnCheck KEV · CVE-2026-16812
VulnCheck KEV · CVE-2026-16812 - VulnCheck KEV · 2026-07-31T00:00:00ZVulnCheck KEV · CVE-2026-16812
- VulnCheck KEV · 2026-08-06T00:00:00ZVulnCheck KEV · CVE-2026-16812
- VulnCheck KEV · 2026-08-07T00:00:00ZVulnCheck KEV · CVE-2026-16812
- VulnCheck KEV · 2026-09-03T00:00:00ZVulnCheck KEV · CVE-2026-16812
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Arista | Velocloud Orchestrator | ≥ 5.2.0 and < 5.2.3.14 |
| Arista | Velocloud Orchestrator | ≥ 6.1.0 and < 6.1.3.4 |
| Arista | Velocloud Orchestrator | ≥ 6.4.0 and < 6.4.2.4 |
| Arista | Velocloud Orchestrator | 7.0.0 |
All CVSS metrics
- CRITICAL 10 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CRITICAL 10 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P - CRITICAL 10 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X - CRITICAL 10 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
Patches & mitigations
- https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144 CVE record · Arista · Updated 2026-07-27T16:11:00.968Z
NVD · CVE-2026-16812 · Updated 2026-10-24T13:10:00.147
VulnCheck KEV · CVE-2026-16812 · Updated 2026-07-27T00:00:00Z
Advisories
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812 CVE record · CISA-ADP · Updated 2026-07-28T03:56:40.567Z
NVD · CVE-2026-16812 · Updated 2026-10-24T13:10:00.147 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49334 EUVD · EUVD-2026-49334
- https://vulncheck.com/kev VulnCheck KEV · CVE-2026-16812 · Updated 2026-07-27T00:00:00Z
Technical & other
- https://previdian.com/CVE-2026-16812 VulnCheck KEV · CVE-2026-16812 · Updated 2026-07-27T00:00:00Z
- https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json VulnCheck KEV · CVE-2026-16812 · Updated 2026-07-27T00:00:00Z
- https://cydome.io/maritime-cybersecurity-bulletin-july-31st-2026/ VulnCheck KEV · CVE-2026-16812 · Updated 2026-07-27T00:00:00Z
- https://www.resecurity.com/es/blog/article/cve-2026-16812-critical-command-injection-in-arista-velocloud-orchestrator VulnCheck KEV · CVE-2026-16812 · Updated 2026-07-27T00:00:00Z
- https://www.recordedfuture.com/blog/july-2026-cve-landscape VulnCheck KEV · CVE-2026-16812 · Updated 2026-07-27T00:00:00Z
- https://www.trellix.com/blogs/research/the-bug-report-august-2026-edition/ VulnCheck KEV · CVE-2026-16812 · Updated 2026-07-27T00:00:00Z
Sources: NVD · CVE.org · All sources and attribution · EPSS