CVE-2026-16812
Actively exploited. CVE-2026-16812 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-07-27) — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.
Serial Number: AV26-751 Date: July 28, 2026 As of July 27, 2026, Arista Networks is affected by vulnerabilities in the following product: VeloCloud Orchestrator On-Prem from 5.2.0 to versions prior to 5.2.3.14 from 6.1.0 to versions prior to 6.1.3.4 from 6.4.0 to versions prior to 6.4.2.4 from 7.0.0 to versions prior to 7.0.0.1 On July 27, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-16812 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security Advisory 0144 Security Advisory 0145 CISA KEV: CVE-2026-16812
CSIRTS triage
- What
- A vulnerability has been identified that is listed in the CISA KEV Database.
- Who is affected
- Users and administrators of VeloCloud Orchestrator versions specified.
- Urgency
- Remediation is urgent as the vulnerability is actively exploited.
- Action
- Users should apply necessary updates as they become available.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-16812
Get an email if CVE-2026-16812 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 56% of all EPSS-scored CVEs.
Advisory coverage (4)
- unknownexploitedArista Networks security advisory (AV26-751)cccs · 2026-07-28
- criticalexploitedCVE-2026-16812: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote …nvd · 2026-07-27
- highexploitedCISA Adds Two Known Exploited Vulnerabilities to Catalogcisa · 2026-07-27
- criticalexploitedCVE-2026-16812: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerabilitycisa-kev · 2026-07-27
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-16812)