CVE-2026-16812: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
CSIRTS triage
- What
- An OS command injection vulnerability may allow remote access to privileged functionality.
- Who is affected
- Users of the on-prem versions of VeloCloud Orchestrator.
- Urgency
- This is critical and urgent due to active exploitation.
- Action
- Apply the latest patches provided by Arista immediately.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch VeloCloud Orchestrator
Get an email when a new VeloCloud Orchestrator advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-16812
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-16812Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 56% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-16812 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedArista Networks security advisory (AV26-751)cccs
- criticalexploitedCVE-2026-16812: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote …nvd
- highexploitedCISA Adds Two Known Exploited Vulnerabilities to Catalogcisa
More from CISA Known Exploited Vulnerabilities
- criticalCVE-2026-20316: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability2026-07-29
- criticalCVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability2026-07-27
- criticalCVE-2026-16232: Check Point SmartConsole Improper Authentication Vulnerability2026-07-22
- criticalCVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability2026-07-22
- criticalCVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Vulnerability2026-07-21