Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw

Back Thehackernews

Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw

Thehackernews • July 28, 2026

Share: View original

Learn how 300 enterprise leaders are managing AI-driven open-source risk, remediation debt, and governance at scale.

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Command Injection Vulnerability in Arista VeloCloud Orchestrator Under Active Exploitation A critical command injection vulnerability, CVE-2026-16812, has been discovered in the Arista VeloCloud Orchestrator On-Prem platform, allowing unauthenticated remote attackers to execute arbitrary commands. This flaw, with a CVSS score of 10.0, poses significant risks to organizations using the platform, potentially leading to data breaches and service disruptions. The vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on July 27, 2026, confirming active exploitation. Arista has advised affected users to immediately patch their systems or restrict access to trusted networks. The vulnerability affects on-premises deployments, while hosted versions have already been patched. Attackers can exploit the flaw by sending crafted HTTP requests to the orchestrator's web interface. Arista has shared three IP addresses associated with the attacks and recommended monitoring for suspicious activity. The urgency of the situation has prompted CISA to mandate federal agencies to apply patches by July 30, 2026. 23 sources 84

Extracted Entities

CWE Weaknesses (1)

CWE-78 - OS Command Injection

Platforms (1)

Arista VeloCloud Orchestrator