Back Ground.News

Arista patches VeloCloud Orchestrator zero-day exploited in attacks

Ground.News • July 28, 2026

Arista has patched a VeloCloud Orchestrator (VCO) security hole that has been actively leveraged in the wild, one that the vendor says “may allow a remote attacker to access privileged internal functionality and impact the VCO host.” The Arista security advisory added that the hole “may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.” Furthermore, it said, “there is no configu…

A critical flaw in Arista's VeloCloud Orchestrator has gone from zero to KEV in short order, with the networking giant confirming attackers are already exploiting it. The vulnerability, tracked as CVE-2026-16812, carries a maximum CVSS score of 10.0 and affects VeloCloud Orchestrator On-Prem, the self-hosted version of the software that enterprises use to centrally manage VeloCloud software-defined wide area networks (SD-WANs) connecting branch …

Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks.

A critical vulnerability in Arista VeloCloud Orchestrator is actively exploited. CISA puts the gap with a maximum of 10.0 on the KEV list. A critical vulnerability in local installations of the Arista VeloCloud Orchestrator (VCO) is currently actively exploited. The vulnerability is managed under the CVE-2026-16812 identifier and reaches the maximum CVSS severity of 10.0. It is an operating system command injection that allows the execution of a…

Impacting on-premises deployments, the OS command injection allows attackers to access privileged internal functionality.

The IT security agency CISA reports attacks on vulnerabilities in Fortinet FortiOS and Arista VeloCloud.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Command Injection Vulnerability in Arista VeloCloud Orchestrator Under Active Exploitation A critical command injection vulnerability, CVE-2026-16812, has been discovered in the Arista VeloCloud Orchestrator On-Prem platform, allowing unauthenticated remote attackers to execute arbitrary commands. This flaw, with a CVSS score of 10.0, poses significant risks to organizations using the platform, potentially leading to data breaches and service disruptions. The vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on July 27, 2026, confirming active exploitation. Arista has advised affected users to immediately patch their systems or restrict access to trusted networks. The vulnerability affects on-premises deployments, while hosted versions have already been patched. Attackers can exploit the flaw by sending crafted HTTP requests to the orchestrator's web interface. Arista has shared three IP addresses associated with the attacks and recommended monitoring for suspicious activity. The urgency of the situation has prompted CISA to mandate federal agencies to apply patches by July 30, 2026. 23 sources 84

Extracted Entities

Arista patches VeloCloud Orchestrator zero-day exploited in attacks

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)