In CISA KEV10.0 CriticalCWE-78
CVE-2026-16812
Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
AristaVeloCloud Orchestrator
Status
- Exploited in the wild
- In CISA KEV since 27 Jul
- Vendor fix available
Federal deadlineThu 30 Jul, 23:59 UTC
Passed 87 days ago
CISA KEV · added 27 Jul
Exploit probabilityEPSSchecked 25 Oct
1.0%probability of exploitation in the next 30 days
Higher than 63% of scored CVEs
SeverityCVSS
10.0Critical
Description NVD
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage 8 articles · 4 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 27 Jul · 16:56 UTC | SecurityOnline | Arista Warns of Actively Exploited VeloCloud Orchestrator Bug |
| Mon 27 Jul · 22:32 UTC | SecurityOnline | CISA adds Arista VeloCloud RCE and Fortinet FortiOS bypass to KEV |
| Mon 27 Jul · 22:52 UTC | CISA | OS command injection flaw hits Arista VeloCloud, CISA issues alert |
| Tue 28 Jul · 01:12 UTC | CISA | CISA KEV Catalog Flags CVE-2026-16812 in Arista VeloCloud |
| Tue 28 Jul · 06:51 UTC | SecurityWeek | Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day |
| Tue 28 Jul · 09:01 UTC | Security Affairs | U.S. CISA adds Arista VeloCloud Orchestrator and Fortinet FortiOS flaws to its Known Exploited Vulnerabilities catalog |
| Mon 3 Aug · 03:01 UTC | SecurityOnline | Attackers Exploit VMware, WordPress Zero Days in New CVE Wave |
| Fri 23 Oct · 10:59 UTC | SecurityWeek | Arista VeloCloud Flaw Marks Third Exploited Orchestrator Zero-Day |
- Arista VeloCloud Flaw Marks Third Exploited Orchestrator Zero-DaySecurityWeek · mentions it in passing
- Attackers Exploit VMware, WordPress Zero Days in New CVE WaveSecurityOnline
- U.S. CISA adds Arista VeloCloud Orchestrator and Fortinet FortiOS flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · mentions it in passing
- Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-DaySecurityWeek
- CISA KEV Catalog Flags CVE-2026-16812 in Arista VeloCloudCISA · official notice
- OS command injection flaw hits Arista VeloCloud, CISA issues alertCISA · official notice
- CISA adds Arista VeloCloud RCE and Fortinet FortiOS bypass to KEVSecurityOnline
- Arista Warns of Actively Exploited VeloCloud Orchestrator BugSecurityOnline · first in our coverage