CVE-2026-16812: Arista VeloCloud Orchestrator on-prem OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 4.0 base score of 10.0 with no authentication or interaction required, active exploitation confirmed by the vendor, and CISA KEV listing with a near-term remediation due date.

What it is

VeloCloud Orchestrator (VCO) on-prem exposes privileged internal functionality that was meant for internal use only but is remotely reachable, allowing OS command injection. Successful exploitation can compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. The vendor states the issue was found externally and is known to be actively exploited, and that hosted and dedicated VCO were patched in advance of the notice.

Impact

An unauthenticated remote attacker can execute commands on the VCO host, gaining control over the orchestrator and the managed data, with full loss of confidentiality, integrity and availability.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS 4.0 vector (AV:N/PR:N/UI:N). The flaw is in an internal-only function that should not have been remotely accessible.

Exploitation

Listed in CISA KEV with a due date of 2026-07-30 and the vendor states it is known to be actively exploited; EPSS 30-day probability is 0.01568 (74th percentile), so exploitation is confirmed rather than speculative.

What to do

• Apply the Arista security advisory 0144 fix to on-prem VCO immediately; hosted and dedicated versions are already patched.
• If patching cannot be completed before the CISA due date, restrict network access to the VCO management interface to trusted hosts and discontinue exposure per BOD 26-04 guidance.
• Isolate the orchestrator from untrusted networks and segment it from the workloads and data it manages.
• Rotate credentials and secrets stored or managed by VCO after any suspected exposure.
• Follow CISA BOD 26-04 and the referenced forensics triage requirements for internet-exposed assets.

Detection

• Review VCO host and application logs for unexpected command execution or access to internal-only endpoints.
• Hunt for outbound connections or process activity on the VCO host that does not match normal orchestrator behavior.
• Monitor network traffic to the VCO management interface from unexpected or external source addresses.
• Check for signs of post-exploitation persistence, new accounts or modified orchestrator configuration.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.