Arista VeloCloud Orchestrator OS Command Injection Vulnerability Exploited
Arista Networks has confirmed that a critical OS command injection vulnerability (CVE-2026-16812) in on-premises versions of VeloCloud Orchestrator is being actively exploited. Affected versions include VCO 5.2.x prior to 5.2.3.14, VCO 6.1.x prior to 6.1.3.4, VCO 6.4.x prior to 6.4.2.4, and VCO 7.0.x prior to 7.0.0.1.
What happened
The vulnerability, tracked as CVE-2026-16812 with a CVSS score of 10.0, allows remote attackers to execute arbitrary commands and access privileged internal functionality. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and managed data.
Arista Networks has released patches for affected versions. Users are advised to upgrade to the latest version of arista-velocloud-orchestrator and review access controls to mitigate potential exploitation. As indicators of compromise, Arista has shared three IP addresses (8.19.75.217, 206.72.242.124, 206.72.242.162) that were involved in the attacks.
For more details, consult the primary sources: [The Hacker News](https://thehackernews.com/2026/07/attackers-exploit-arista-velocloud.html), [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog#CVE-2026-16812), and [SecurityWeek](https://www.securityweek.com/critical-arista-velocloud-orchestrator-vulnerability-exploited-as-zero-day/).
How 0Day mitigates this
arista-velocloud-orchestrator is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.