CVE-2026-16812Active Exploitation(arista / velocloud_orchestrator)

CRITICALCVSS 10.0 · CRITICALCISA KEV

Exploitation observed; activity peaked at 37 mentions and remains active

Immediate actions

Patch arista velocloud_orchestrator systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.

arista CVEs Back to dashboard

8.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-07-30. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor / third-party advisories

https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812

Weakness type (CWE)

CWE-78

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

velocloud_orchestrator

Threat summary

Active exploitation appears in 68 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
86 mentions across 19 observed days

What's happening

Active exploitation reported across 68 signals
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 6 signals
Patch or workaround mentioned in 44 signals
Technical details provided in 65 signals
Disclosure: 6 classified signals
General: 5 classified signals
Peaked 17d ago at 37 mentions (2026-07-28); latest day: 1
86 total mentions across 19 days

Affected systems

Vendors

arista

Products

velocloud_orchestrator

1 version affected across 1 product

Deep dive

Activity timeline86 mentions / 19d

Signal classification6 categories

Active Exploitation

6777.9%

Disclosure

67.0%

General

55.8%

Patch

55.8%

PoC

22.3%

Exploit

11.2%

Referenced assets64 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-27	14	Active Exploitation9Disclosure2General2PoC1
2026-07-28	37	Active Exploitation30General1Patch5PoC1
2026-07-29	5	Active Exploitation4General1
2026-07-30	5	Active Exploitation4Exploit1
2026-07-31	2	Active Exploitation2
2026-08-01	1	Active Exploitation1
2026-08-03	3	Active Exploitation3
2026-08-04	1	Active Exploitation1
2026-08-06	2	Active Exploitation1Disclosure1
2026-08-07	4	Active Exploitation2Disclosure1General1
2026-08-08	3	Active Exploitation2Disclosure1
2026-08-09	1	Active Exploitation1
2026-08-10	2	Active Exploitation2
2026-08-30	1	Disclosure1
2026-09-22	1	Active Exploitation1
2026-09-30	1	Active Exploitation1
2026-10-23	1	Active Exploitation1
2026-10-24	1	Active Exploitation1
2026-10-26	1	Active Exploitation1

Full discourse20 posts

CISA Cyber@CISACyber91d
Active Exploitation
🛡️We added Fortinet FortiOS vulnerability CVE-2025-68686 and Arista Networks VeloCloud Orchestrator On-Prem CVE-2026-16812 to our KEV Catalog. Visit http://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/QVcUhjwn0z
Post summary
The tweet announces that CVE-2025-68686 and CVE-2026-16812 have been added to a KEV catalog, implying they are actively exploited and prompts users to apply mitigations.
12403789.4K
302.4K followersView on X
Cytex@cytexsmb90d
Active Exploitation
A CVSS 10.0 vulnerability in Arista's VeloCloud Orchestrator is being actively exploited, and there's no configuration change that can stop it, only a patch. The flaw, tracked as CVE-2026-16812, is an OS command injection affecting on-premises deployments. No authentication is required. No special configuration is needed. The VCO web interface is exposed by default, and Arista confirms there is no configuration that can prevent exposure. A remote attacker with network access to that interface can access privileged internal functionality intended for internal use only. Arista discovered the issue externally and confirmed active exploitation. The company has already patched hosted and dedicated versions in advance of this advisory. CISA added the flaw to its KEV catalog, giving federal agencies until July 30, 2026, to apply the patch—though they have until August 10, 2026, to implement it. There are currently no details on how the vulnerability is being exploited, the scale of attacks, or who is behind them. Arista published three IP addresses observed conducting attacks and advised operators to review logs for unusual URL-like path components, encoded characters, and unexpected privileged actions. The recommended resolution is to upgrade to a fixed release. Until then, restrict VCO web interface access to trusted administrative networks and monitor for unexpected outbound activity. For security leaders, the key takeaway is that this vulnerability bypasses authentication entirely. If your VCO is internet-accessible, assume it has been scanned, and investigate any anomalous activity immediately. Compromise of the orchestrator may grant attackers access to managed VeloCloud Edge devices as well. For those running VeloCloud Orchestrator on-premises, how quickly can you patch, and are you already seeing the published IPs in your logs?
Post summary
Arista’s CVE‑2026‑16812, an OS command‑injection flaw in VeloCloud Orchestrator with a CVSS 10.0 score, is confirmed to be actively exploited in the wild; patches are available and operators must restrict interface access and monitor logs.
25053139
852 followersView on X
CHILLINT@CHILL_INT87d
Active Exploitation
Maximum-severity #Arista VeloCloud zero-day under active attack: CVE-2026-16812 (CVSS 10.0), an unauthenticated command-injection flaw in on-prem VeloCloud Orchestrator, is being exploited in the wild and is now in CISA's KEV catalog. Patch now. https://thehackernews.com/2026/07/attackers-exploit-arista-velocloud.html
Post summary
The post warns about CVE‑2026‑16812, a critical unauthenticated command‑injection flaw in Arista VeloCloud Orchestrator that is actively being exploited and listed in CISA’s KEV catalog, and it urges immediate patching.
120222.8K
215 followersView on X
ROOTCAUSE@rootcausehq91d
Active Exploitation
Actively exploited: CVE-2026-16812, OS command injection in Arista VeloCloud Orchestrator on-prem. A remote attacker reaches privileged internal functionality and compromises the orchestrator and the data it manages. CISA added it to KEV. https://nvd.nist.gov/vuln/detail/CVE-2026-16812 #cve #kev https://t.co/kroNF0tBIv
Post summary
CVE-2026-16812, an OS command injection in Arista VeloCloud Orchestrator, is actively exploited and flagged by CISA in the KEV list.
01022102
566 followersView on X
Daily CyberSecurity@Daily_CyberSec91d
Active Exploitation
CVE-2026-16812, a VeloCloud command injection scored CVSS 10, is exploited in the wild. Patch VeloCloud Orchestrator now, plus two related bugs. #VeloCloud #Arista #CVE202616812 #CommandInjection #ExploitedInTheWild #VCO #SSRF #Cybersecurity http://securityonline.info/velocloud-command-injection-cve-2026-16812/
Post summary
CVE‑2026‑16812 is a high‑severity command injection in VeloCloud that is already being exploited in the wild, and a patch for the Orchestrator is available now.
01031465
13.0K followersView on X
Daily CyberSecurity@Daily_CyberSec89d
Exploit
Arista addresses CVE-2026-16812, a critical vulnerability in VeloCloud Orchestrator actively exploited to gain unauthenticated remote code execution. #Arista #VeloCloud #Cybersecurity #CVE202616812 #RCE http://meterpreter.org/arista-velocloud-orchestrator-cve-2026-16812/
Post summary
The post announces that CVE-2026-16812, a critical unauthenticated RCE vulnerability in VeloCloud Orchestrator, is actively exploited and links to a meterpreter-based PoC, indicating an available exploit tool.
02011453
12.6K followersView on X
ExploitGrid@exploitgrid90d
General
🛡️ ExploitGrid Daily Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-11756 CVE-2026-16812 CVE-2026-48030 CVE-2026-15014 CVE-2026-51303 ..🧵👇
Post summary
The digest merely lists a set of CVE identifiers without providing any PoC, exploit details, or mitigation information.
1102033
27 followersView on X
Netlas.io@Netlas_io91d
Active Exploitation
CVE-2026-16812: OS Command injection in VeloCloud Orchestrator, 10.0 rating ‍🔥 A new vulnerability in Arista VeloCloud Orchestrator (VCO) allows an unauthenticated remote attacker run OS commands on the VCO host. A compromise can also expose managed devices. This vulnerability is already being actively exploited in the wild! 👉 https://nt.ls/PkM4n
Post summary
Arista VeloCloud Orchestrator suffers a critical OS command injection flaw (CVE-2026-16812) that lets unauthenticated attackers execute host commands and expose managed devices. The vulnerability is already being exploited in the wild.
01020619
7.7K followersView on X
Hexnode@thehexnode88d
Active Exploitation
This week’s What to Watch, Patch, and Secure roundup covers emerging threats, patching priorities, and enterprise exposure risks. 🔹 SharePoint RCE CVE-2026-50522 Attackers are exploiting an on-premises SharePoint RCE flaw that can expose IIS machine keys, making investigation and key rotation just as important as patching. https://www.hexnode.com/blogs/cve-2026-50522-sharepoint-rce-why-patching-is-not-enough/ 🔹 Arista VeloCloud SD-WAN zero-day Arista patched CVE-2026-16812 after active exploitation against on-premises VeloCloud Orchestrator deployments, putting SD-WAN management infrastructure in focus. https://www.hexnode.com/blogs/arista-velocloud-cve-2026-16812-exploited-sd-wan-zero-day-response-guide/ 🔹 Critical NGINX heap overflow CVE-2026-42533 affects specific regex-based NGINX map configurations, showing why patch management must account for both software versions and configuration exposure. https://www.hexnode.com/blogs/critical-nginx-heap-overflow-puts-patch-management-back-in-focus/ 🔹 Certighost AD CS domain takeover risk A public PoC for CVE-2026-54121 shows how AD CS abuse could allow an authenticated attacker to impersonate a domain controller and escalate toward domain compromise. https://www.hexnode.com/blogs/certighost-cve-2026-54121-adcs-domain-takeover/ 🔹 PAN-OS VPN flaw CVE-2026-0257 A PAN-OS GlobalProtect VPN flaw has been linked to intrusions that led to Qilin ransomware deployment, reinforcing the need to review VPN access and post-compromise activity. https://www.hexnode.com/blogs/pan-os-vpn-flaw-cve-2026-0257/ 🔹 LegacyHive zero-day LegacyHive targets the Windows User Profile Service and currently has no official Microsoft patch or CVE, making endpoint monitoring and interim mitigations important. https://www.hexnode.com/blogs/legacyhive-zero-day-enterprise-response-before-microsofts-fix/ 🔹 Estée Lauder Oracle EBS breach Estée Lauder disclosed unauthorized access to an Oracle E-Business Suite environment used for HR operations, exposing the identity risks tied to enterprise application security gaps. https://www.hexnode.com/blogs/estee-lauder-oracle-ebs-breach-enterprise-security/ Stay informed, prioritize what matters, and strengthen your security posture one week at a time.
Post summary
The roundup highlights several newly disclosed CVEs—some with active exploitation reported—emphasizing both the need for rapid patching and concrete mitigations while noting PoC references for further detail.
10010216
17.6K followersView on X
Cybendium@cybendium88d
Active Exploitation
CVE-2026-16812 : injection de commandes non authentifiée, notée 10/10, dans VeloCloud Orchestrator, la console SD-WAN d'Arista. Activement exploitée, au catalogue CISA. https://cybendium.fr/veille/arista-velocloud-cve-2026-16812-sdwan
Post summary
CVE-2026-16812 is a critical unauthenticated command injection vulnerability in Arista VeloCloud Orchestrator, actively exploited in the wild and catalogued by CISA.
1001057
12 followersView on X
كاسبر سكاي@KasperskyDev89d
Active Exploitation
⚠️ ثغرة حرجة في منصة إدارة الشبكات تُتيح حقن أوامر بلا مصادقة — تُستغل الآن. المعرّف : CVE-2026-16812 درجة الخطورة : 10.0 (CVSS) - Critical المنتج : VeloCloud Orchestrator On-Prem الحل : Upgrade to 5.2.3.14 / 6.1.3.4 / 7.0.0.1 #Arista #CVE202616812
Post summary
CVE‑2026‑16812 is a critical command‑injection flaw in VeloCloud Orchestrator On‑Prem that is being actively exploited; upgrade to the listed patched versions immediately.
11000427
39.9K followersView on X
Autumn Good@autumn_good_3590d
Active Exploitation
🚨🚨🚨 『This issue was discovered externally and is known to be actively exploited.』 CVE-2026-16812 Security Advisory 0144 - Arista https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144
Post summary
The post highlights that CVE-2026-16812 is actively exploited, but offers no additional technical, PoC, or patch details.
00011415
7.0K followersView on X
CloudSecurityAlliance@cloudsa90d
Active Exploitation
CISO Daily Briefing: Arista VeloCloud Orchestrator zero-day (CVE-2026-16812, CVSS 10.0) is under active exploitation — CISA's KEV deadline is Thursday; also patch TeamCity's new unauthenticated RCE (CVE-2026-63077, CVSS 9.8) and the Certighost AD CS forgery bug (CVE-2026-54121). Governance: NVIDIA's 37-member Open Secure AI Alliance pitches AI-agent guardrails with no charter, board, or timeline — OpenAI, Anthropic, Google all sat out. Strategic: OpenAI's July 25 ChatGPT/API/Codex outage, its 4th in 4 days, makes single-vendor LLM concentration risk real, not theoretical. https://labs.cloudsecurityalliance.org/ciso-daily-briefing-2026-07-28
Post summary
The briefing reports that Arista VeloCloud Orchestrator's zero‑day is actively exploited, PX hints at urgency for patches, and a related TeamCity RCE is patched, underscoring the immediate threat.
00020528
18.9K followersView on X
AlphaHunt Converge@alphahunt_io90d
Active Exploitation
Today's AlphaHunt CTI Forecast for 2026-07-28 Over the next week, exposed on-prem VeloCloud Orchestrators are likely to become a valuable intrusion pivot—not another appliance chore. #CTI CVE-2026-16812 is an unauthenticated command-injection flaw in VCO. Arista says it is actively exploited; fixed releases are available for supported trains. An orchestration plane concentrates administrator workflows, configuration authority, and managed-edge reach. Quiet control can be worth more than a noisy single-device foothold. Inventory VCO, restrict its web interface, patch, and preserve administrator/API/configuration telemetry first. Escalate on new identities, config pushes, or outbound activity; narrow if exposure is fixed and quiet. https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144 https://www.securityweek.com/critical-arista-velocloud-orchestrator-vulnerability-exploited-as-zero-day/
Post summary
Arista confirms CVE-2026-16812, a command‑injection flaw in VeloCloud Orchestrator, is being actively exploited and that patched versions are available.
00020212
150 followersView on X
Red Secure Tech Ltd.@redsecuretech91d
Active Exploitation
A maximum-severity flaw in Arista VeloCloud Orchestrator is being actively exploited.Patch now. CISA adds CVE-2026-16812 to its KEV catalog. For More: https://www.redsecuretech.co.uk/blog/post/arista-velocloud-vulnerability-under-active-exploitation/1352 #Arista #VeloCloud #CVE #CriticalVulnerability #ActiveExploitation #CISA #KEV #NetworkSecurity #InfoSec https://t.co/Bmmk6E8UO2
Post summary
CVE-2026-16812 is a maximum‑severity flaw in Arista VeloCloud Orchestrator that is being actively exploited; a patch is available and the vulnerability has been added to CISA’s KEV catalog.
0101039
69 followersView on X
The Daily Tech Feed@dailytechonx91d
Active Exploitation
Arista Networks has identified a critical vulnerability (CVE-2026-16812) in its VeloCloud Orchestrator, currently under active exploitation. This flaw allows unauthenticated attackers to execute arbitrary commands, compromising system integrity. Organizations are urged to update to the latest versions or implement recommended mitigations to protect their networks. #Arista #VeloCloud #CVE202616812 #CyberSecurity #NetworkSecurity #CISA https://thedailytechfeed.com/arista-velocloud-orchestrator-vulnerability-exploited-in-active-attacks/
Post summary
CVE-2026-16812 is actively exploited, allowing remote command execution; users are advised to apply patches or mitigations promptly.
0001171
573 followersView on X
キタきつね@foxbook91d
Active Exploitation
CISAが既知の悪用された脆弱性2件をカタログに追加 CISA Adds Two Known Exploited Vulnerabilities to Catalog #CISA (Jul 27) CVE-2025-68686 Fortinet FortiOSにおける機密情報の不正アクセス脆弱性 CVE-2026-16812 Arista VeloCloud Orchestrator オンプレミス OS コマンドインジェクションの脆弱性 https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
Post summary
CISA has added CVE-2025-68686 and CVE-2026-16812 to its catalog of known exploited vulnerabilities, confirming active exploitation, but the notice provides no patches, PoCs, or exploit code.
00011376
4.9K followersView on X
ねこさん⚡(ΦωΦ)@catnap70791d
Active Exploitation
米当局、「FortiOS」「VeloCloud Orchestrator」の脆弱性悪用を確認：Security NEXT https://www.security-next.com/187925 "CISAは現地時間2026年7月27日、「悪用が確認された脆弱性カタログ（KEV）」へ2件の脆弱性「CVE-2026-16812」「CVE-2025-68686」を追加した"
Post summary
CISA has listed CVE-2026-16812 and CVE-2025-68686 in its Known Exploited Vulnerabilities catalog, indicating confirmed active exploitation of FortiOS and VeloCloud Orchestrator vulnerabilities.
00011173
3.5K followersView on X
Daily CyberSecurity@Daily_CyberSec91d
Active Exploitation
CISA KEV additions on July 27 flag two known exploited vulnerabilities: Arista VeloCloud CVE-2026-16812 and FortiOS CVE-2025-68686. Patch both now. #CISA #KEV #Arista #VeloCloud #Fortinet #FortiOS #CVE #ExploitedInTheWild #Cybersecurity http://securityonline.info/cisa-kev-arista-velocloud-fortios/
Post summary
CISA KEV identifies two actively exploited CVEs (Arista VeloCloud CVE-2026-16812 and FortiOS CVE-2025-68686) and urges immediate patching.
00011402
12.6K followersView on X
ExploitGrid@exploitgrid91d
General
#ExploitGrid Daily Threat Digest Top #Vulnerabilities (CVEs) of the day CVE-2026-16812 CVE-2026-12394 CVE-2026-13714 CVE-2026-63077 CVE-2026-66395 ..🧵👇
Post summary
The tweet lists five CVEs as top vulnerabilities for the day but offers no additional context, PoC, exploit, or patch information.
1100057
28 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	arista	velocloud_orchestrator	-	-	-
App	arista	velocloud_orchestrator	7.0.0	-	-

Explore more

Back to dashboard arista CVEs velocloud_orchestrator vulnerabilities

What researchers are saying

CVE-2026-16812

Cytex[verified]@cytexsmbActive Exploitation

Arista’s CVE‑2026‑16812, an OS command‑injection flaw in VeloCloud Orchestrator with a CVSS 10.0 score, is confirmed to be actively exploited in the wild; patches are available and operators must restrict interface access and monitor logs.

ROOTCAUSE[verified]@rootcausehqActive Exploitation

CVE-2026-16812, an OS command injection in Arista VeloCloud Orchestrator, is actively exploited and flagged by CISA in the KEV list.

Netlas.io[verified]@Netlas_ioActive Exploitation

Arista VeloCloud Orchestrator suffers a critical OS command injection flaw (CVE-2026-16812) that lets unauthenticated attackers execute host commands and expose managed devices. The vulnerability is already being exploited in the wild.

Hexnode[verified]@thehexnodeActive Exploitation

The roundup highlights several newly disclosed CVEs—some with active exploitation reported—emphasizing both the need for rapid patching and concrete mitigations while noting PoC references for further detail.

CloudSecurityAlliance[verified]@cloudsaActive Exploitation

The briefing reports that Arista VeloCloud Orchestrator's zero‑day is actively exploited, PX hints at urgency for patches, and a related TeamCity RCE is patched, underscoring the immediate threat.

AlphaHunt Converge[verified]@alphahunt_ioActive Exploitation

Arista confirms CVE-2026-16812, a command‑injection flaw in VeloCloud Orchestrator, is being actively exploited and that patched versions are available.

The Daily Tech Feed[verified]@dailytechonxActive Exploitation

CVE-2026-16812 is actively exploited, allowing remote command execution; users are advised to apply patches or mitigations promptly.

キタきつね[verified]@foxbookActive Exploitation

CISA has added CVE-2025-68686 and CVE-2026-16812 to its catalog of known exploited vulnerabilities, confirming active exploitation, but the notice provides no patches, PoCs, or exploit code.