Back Feeds.Feedburner

Arista patches critical command injection flaw in VeloCloud Orchestrator exploited in attacks

Feeds.Feedburner •SC Staff • July 28, 2026

As reported by Bleeping Computer, Arista released a patch for a critical command injection vulnerability affecting on-premises VeloCloud Orchestrator (VCO) deployments. This flaw, identified as CVE-2026-16812, carries the maximum severity score of 10.0 and is reportedly being actively exploited in the wild.

The unauthenticated OS command injection vulnerability allows remote attackers to execute arbitrary commands with privileged access on the VCO, potentially compromising the confidentiality, integrity, and availability of the orchestrator and its managed data. Exploitation requires only network access to the VCO web interface, without the need for any credentials. Arista has confirmed that this vulnerability is actively exploited, though details on the attackers and the timeline of attacks remain undisclosed. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog, mandating U.S. federal agencies to address it by July 30, 2026. Affected versions include specific releases of VCO 5.2.x, 6.1.x, 6.4.x, and 7.0.x. Arista advises customers to restrict network access to the VCO web interface and monitor for suspicious activity, including connections from known malicious IP addresses like 8.19.75.217, 206.72.242.124, and 206.72.242.162.

Source: Bleeping Computer

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Command Injection Vulnerability in Arista VeloCloud Orchestrator Under Active Exploitation A critical command injection vulnerability, CVE-2026-16812, has been discovered in the Arista VeloCloud Orchestrator On-Prem platform, allowing unauthenticated remote attackers to execute arbitrary commands. This flaw, with a CVSS score of 10.0, poses significant risks to organizations using the platform, potentially leading to data breaches and service disruptions. The vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on July 27, 2026, confirming active exploitation. Arista has advised affected users to immediately patch their systems or restrict access to trusted networks. The vulnerability affects on-premises deployments, while hosted versions have already been patched. Attackers can exploit the flaw by sending crafted HTTP requests to the orchestrator's web interface. Arista has shared three IP addresses associated with the attacks and recommended monitoring for suspicious activity. The urgency of the situation has prompted CISA to mandate federal agencies to apply patches by July 30, 2026. 23 sources 84

Extracted Entities

Arista patches critical command injection flaw in VeloCloud Orchestrator exploited in attacks

The full story

Extracted Entities

CVEs (1)

IP Addresses (2)

MITRE ATT&CK (2)