CVE-2026-16812: Arista VeloCloud Orchestrator — Unauthenticated OS Command Injection

Executive Summary

CVE-2026-16812 is a critical unauthenticated OS command injection vulnerability in Arista VeloCloud Orchestrator (VCO) On-Prem deployments. The flaw carries a CVSS v3.1 base score of 10.0 — maximum severity — reflecting the combination of network accessibility, zero authentication requirement, and full compromise of the orchestrator host including all managed SD-WAN infrastructure.

The vulnerability has been actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on 27 July 2026 with a patch deadline of 30 July 2026 — three days from disclosure. Arista has confirmed exploitation and released patched versions for all supported VCO branches.

VeloCloud Orchestrator is the management plane for Arista’s SD-WAN product line, used by enterprises and service providers to manage WAN edges, gateways, and network policies across distributed sites. Compromise of VCO gives an attacker centralised control over all downstream network infrastructure managed by that instance.

Affected Versions

Vulnerable:

• VeloCloud Orchestrator < 5.2.3.14
• VeloCloud Orchestrator < 6.1.3.4
• VeloCloud Orchestrator < 6.4.2.4
• VeloCloud Orchestrator < 7.0.0.1

Not affected:

• VCO 5.2.3.14 and later
• VCO 6.1.3.4 and later
• VCO 6.4.2.4 and later
• VCO 7.0.0.1 and later
• VeloCloud Orchestrator Hosted deployments (pre-patched before disclosure)
• VeloCloud Orchestrator Dedicated deployments (pre-patched before disclosure)
• VeloCloud Gateway and VeloCloud Edge products (not affected)

Vulnerability Details

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The flaw exists because the VCO web interface exposes internal privileged functionality that was intended to be accessible only at the system level, without adequate input sanitisation before OS-level command execution.

An attacker can reach this functionality directly over the network and inject arbitrary OS commands. Because the vulnerable endpoint requires no authentication — no VCO tenant credentials, no operator login — exploitation requires only network access to the VCO web interface.

Public research has identified exploitation code for VeloCloud Orchestrator RCE in the SD-PWN repository on GitHub, suggesting the attack surface for VCO has been known to offensive researchers for some time. The specific endpoint and parameter targeted by CVE-2026-16812 has not been publicly detailed in Arista’s advisory, but the attack vector is consistent with previously documented VCO injection patterns.

The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — Network, Low complexity, No privileges, No user interaction, scope Change (affects systems beyond VCO itself), and High impact on confidentiality, integrity, and availability. The scope change reflects the fact that successful exploitation of VCO provides control over all managed VeloCloud Edges and Gateways, not just the orchestrator host.

Exploitation in the Wild

Arista confirmed exploitation in the wild in its advisory published 27 July 2026. The same-day CISA KEV addition corroborates active exploitation. The three-day patch deadline (July 30) is among the shortest CISA has assigned, indicating assessed urgency.

The attack surface for on-premises VCO installations is significant. VCO management interfaces are sometimes internet-accessible to allow remote management of distributed WAN infrastructure — precisely the exposure that makes zero-authentication exploitation so severe. Hosted and Dedicated deployments operated by Arista were pre-patched before public disclosure, which limits cloud-hosted exposure but leaves on-premises deployments at immediate risk.

Arista has not disclosed specific threat actor attribution or detailed timeline of attacks prior to disclosure.

Patch and Remediation

Immediate action — patch to a fixed version:

Patches are available from Arista’s support portal. This is an on-premises software update requiring orchestrator maintenance window scheduling.

Interim workarounds while patching is arranged:

1. Restrict network access. Place VCO management interfaces behind a firewall or access control list that limits access to known administrative IP ranges. VCO should not be directly internet-accessible without access controls; if it is, this is the highest-priority interim control.
2. Review recent access logs. Examine VCO access logs for unexpected requests to administrative endpoints or unusual configuration changes. Look for connections from external IP addresses not associated with known administrative users.
3. Audit orchestrator configuration. Check for unexpected administrator accounts, unusual policy changes, or new edge/gateway enrollments that were not initiated by your team.

Detection

Network-level indicators:

• Unexpected HTTP requests to VCO administrative or API endpoints from external IP addresses
• Unusual request patterns (irregular path structures, unusual parameters) in web server access logs
• New connections from VCO host to external infrastructure (potential C2 beaconing post-exploitation)
• Unusual outbound traffic from VCO host to unexpected destinations

VCO application indicators:

• Unexpected VCO administrator account creation or modification
• SD-WAN edge or gateway enrollments not initiated by your team
• Policy or configuration changes outside change management windows
• VCO system logs showing unexpected OS-level process execution

Host-level indicators on the VCO server:

• Unusual process execution (shells, curl/wget, python) spawned from the VCO application process
• New cron jobs or scheduled tasks
• Modifications to VCO configuration files outside software update procedures
• New user accounts on the underlying host OS

References

• Arista Security Advisory 0144 — CVE-2026-16812
• CISA KEV — CVE-2026-16812
• NVD — CVE-2026-16812