Arista has patched an actively exploited VeloCloud Orchestrator zero-day that could allow remote attackers to take control of affected on-premises systems.
The vulnerability, tracked as CVE-2026-16812, is an unauthenticated operating system command injection flaw with a maximum CVSS severity score of 10.0.
It affects on-premises VeloCloud Orchestrator, also known as VCO. The platform centrally configures, monitors and manages VeloCloud SD-WAN deployments and connected edge devices.
Arista says attackers need only network access to the VCO web interface. They do not need tenant or operator credentials to exploit the flaw.
CVE-2026-16812 exposes privileged functions
The VeloCloud Orchestrator zero-day lets a remote attacker access privileged functions intended only for internal use.
Successful exploitation could compromise the confidentiality, integrity and availability of both the orchestrator and the information it manages. This may include configuration data, device inventories, credentials, certificates and cryptographic keys.
Arista said VCO web interfaces are exposed by default. Customers cannot use a configuration setting to stop that exposure entirely.
The company confirmed that attackers are actively exploiting CVE-2026-16812. However, it has not disclosed when exploitation began or who is responsible.
Affected VeloCloud Orchestrator versions
The flaw affects the following on-premises VCO releases:
- VCO 5.2.x before version 5.2.3.14
- VCO 6.1.x before version 6.1.3.4
- VCO 6.4.x before version 6.4.2.4
- VCO 7.0.x before version 7.0.0.1
Arista has fixed the issue in VCO versions 5.2.3.14, 6.1.3.4 and 6.4.2.4, as well as later releases. VCO 7.0.0.1 and later versions are also not vulnerable.
Hosted and Dedicated VeloCloud Orchestrator deployments received patches before the public advisory. VeloCloud Gateway and VeloCloud Edge products are not affected by CVE-2026-16812.
Arista has not assessed end-of-support releases. Organisations using unsupported versions should contact Arista’s technical support team to discuss available upgrade options.
CISA adds flaw to exploited vulnerabilities list
The US Cybersecurity and Infrastructure Security Agency has added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog.
Federal civilian executive branch agencies must mitigate the flaw by 30 July 2026 under Binding Operational Directive 22-01.
The addition confirms that the VeloCloud Orchestrator zero-day is being used in real-world attacks. Organisations outside the federal sector should also treat the update as urgent.
Arista shares known malicious IP addresses
Arista identified three IP addresses linked to attempts to exploit the vulnerability:
- 8.19.75.217
- 206.72.242.124
- 206.72.242.162
Administrators should block these addresses and check logs for prior connections. However, the list is not complete. Attackers may have used other infrastructure to target vulnerable systems.
While teams deploy updates, they should limit access to the VCO web interface to trusted administrative networks. They should also monitor for unexpected administrator actions and unusual traffic from the VCO host.
Check for signs of compromise
Security teams should review VCO logs for unusual web requests, encoded characters, abnormal request volumes and references to local or internal services.
Other warning signs include unexpected outbound HTTP or HTTPS traffic, unauthorised configuration changes, suspicious command execution, new files, database exports and archive files.
Teams should also investigate unusual access to VCO databases, device inventories, certificates, credentials and cryptographic keys.
If compromise is suspected, organisations should preserve logs and filesystem timestamps before starting remediation. They should then rotate credentials, review administrator activity, validate managed devices and consider restoring or replacing affected VCO instances.
Applying the patch is essential, but it may not remove an attacker who already exploited the VeloCloud Orchestrator zero-day. A compromised orchestrator could also give attackers a path to connected VeloCloud Edge devices.
0 responses to “VeloCloud Orchestrator Zero-Day Actively Exploited in Attacks”