CVE-2026-16812 is an OS command injection in the on-premises version of Arista's VeloCloud Orchestrator (VCO), the management console for VeloCloud SD-WAN deployments: internal-only functionality was unintentionally reachable remotely, and Arista confirms the issue was discovered externally and is known to be actively exploited from specific malicious IP addresses, while hosted and dedicated VCO instances were already patched before the advisory was published.
Vulnerability summary
10
Critical
1.8%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-07-27
Published
Vulnerability ID: CVE-2026-16812 · Source: NVD (Arista Secondary score only, not NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Arista VeloCloud Orchestrator (on-prem) | cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* | 5.2.0 through 5.2.3.13 (fixed in 5.2.3.14); 6.1.0 through 6.1.3.3 (fixed in 6.1.3.4); 6.4.0 through 6.4.2.3 (fixed in 6.4.2.4); 7.0.0 (fixed in 7.0.0.1) |
What this means
CVE-2026-16812 affects on-premises deployments of Arista VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN fabrics. NVD's description states VCO on-prem "has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host," with successful exploitation able to "compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator." NVD further notes the functionality "was intended to be for internal use only and is not intended to be remotely accessible," that hosted and dedicated VCO versions "have already been patched in advance of this notice going out," and that the issue "was discovered externally and is known to be actively exploited" (NVD).
NVD has not published its own Primary CVSS for this CVE; the only scores on record are Secondary metrics from Arista PSIRT: CVSS v3.1 10.0 (critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CVSS v4.0 10.0, both maximum severity — network-reachable, low attack complexity, no privileges or user interaction required, scope changed, with complete impact to confidentiality, integrity and availability. CWE-78 (OS Command Injection) is the assigned weakness (NVD).
Arista's own security advisory confirms the on-prem-only command-injection flaw, lists fixed releases (5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1 across the respective trains), and is explicit that it is "known to be actively exploited," naming three specific malicious IP addresses observed attacking the vulnerability. Interim mitigations for operators who cannot patch immediately include restricting the VCO web interface to trusted administrative networks, monitoring for traffic from the identified malicious IPs, watching for unexpected outbound network activity from the VCO host, and reviewing administrator activity logs (Arista Security Advisory 0144).
CISA added CVE-2026-16812 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-27, with a required-action due date of 2026-07-30 (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.0176 (77.972th percentile) — a low absolute EPSS score despite the confirmed in-the-wild exploitation and KEV listing, likely reflecting that on-prem VCO is a comparatively narrow deployment footprint; organizations should weigh the maximum CVSS severity and Arista's explicit active-exploitation statement over the EPSS percentile alone (FIRST EPSS).
Any on-premises VeloCloud Orchestrator at or below the affected builds should be upgraded to the fixed release for its train immediately, with network access to the VCO web interface restricted to trusted administrative networks and logs reviewed for the malicious source IPs Arista has published.
Evidence
- On-prem VeloCloud Orchestrator exposes internal-only privileged functionality remotely, compromising confidentiality, integrity, and availability of the orchestrator; discovered externally and known to be actively exploited; hosted/dedicated VCO already patched. — NVD
- CVSS v3.1 and v4.0 scores are both 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, submitted by Arista PSIRT and stored by NVD as Secondary metrics — NVD has not published its own Primary score. — NVD
- Affected on-prem VCO builds: 5.2.0-5.2.3.13, 6.1.0-6.1.3.3, 6.4.0-6.4.2.3, and 7.0.0, fixed in 5.2.3.14/6.1.3.4/6.4.2.4/7.0.0.1 respectively. Known active exploitation from three named malicious IP addresses. — Arista Security Advisory 0144
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-07-27, required action due 2026-07-30. — CISA KEV
- EPSS score is 0.0176 (77.972th percentile) as of 2026-10-30. — FIRST EPSS
