CVE-2026-16812
Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
Description
CVE-2026-16812 is an OS command injection vulnerability in on-premises deployments of Arista VeloCloud Orchestrator (VCO) that exposes internal-only functionality to remote attackers. Functionality that was never intended to be remotely accessible can be reached over the network, allowing an attacker to invoke privileged internal operations and impact the VCO host itself, which compromises the confidentiality, integrity, and availability of the orchestrator and of all data it manages. With a CVSS score of 10.0 (Critical) — the maximum rating, driven by a changed scope on top of unauthenticated network access — CVE-2026-16812 is as severe as a web-facing vulnerability gets, and Arista states that the issue was found externally and is known to be actively exploited. Hosted and Dedicated VCO instances were patched by Arista before the notice was published, so the remaining exposure is with customers who run VCO on-premises. CISA added CVE-2026-16812 to its Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of 2026-07-30.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| arista | velocloud orchestrator | >= 5.2.0, < 5.2.3.14; >= 6.1.0, < 6.1.3.4; >= 6.4.0, < 6.4.2.4; 7.0.0 |
References
- https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OS Command Injection occurs when software builds an operating system command from externally influenced input and fails to neutralise the special elements — semicolons, pipes, backticks, subshell syntax — that can change what the shell actually executes. In VeloCloud Orchestrator the exposure of internal functionality to remote callers means attacker-supplied input reaches privileged command execution on the VCO host, so the attacker gains the ability to run commands with the orchestrator's own operating system rights rather than merely misusing an application feature.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2026-16812 reaches a CVSS 3.1 base score of 10.0 (Critical) because every exploitability metric is at its worst and the scope changes: the vulnerability is remotely exploitable without physical access, easy to exploit with no special conditions needed, requires no authentication, needs no user action, and can affect resources beyond the vulnerable component. Confidentiality (High): the orchestrator holds the configuration, credentials, and topology of an organisation's entire SD-WAN estate, and all of it becomes readable. Integrity (High): command execution on the VCO host lets an attacker alter orchestrator behaviour and push changes that propagate to managed edges. Availability (High): the same access allows the attacker to disable the orchestrator and, with it, central control over the WAN. The changed scope (S:C) is the decisive factor: VCO is a management plane, so compromising it does not stop at one host but reaches the network devices under its control. Arista's confirmation of active exploitation and the CISA KEV listing mean an internet-reachable on-premises VCO should be treated as an incident in progress, not a scheduled patch.
Exploit Maturity
CVE-2026-16812 is confirmed to be under active exploitation by two independent sources: Arista states in its advisory that the issue was discovered externally and is known to be actively exploited, and CISA has added the CVE to its Known Exploited Vulnerabilities catalog with a due date of 2026-07-30; ransomware use is currently marked as Unknown. No public exploit code is linked in the available references — the published sources are the Arista security advisory and the CISA KEV entry — but that offers little comfort for an unauthenticated command execution flaw with a CVSS score of 10.0 that attackers already possess. The EPSS score of 0.88% (55.6th percentile) lags behind reality here, as EPSS reflects observed broad scanning volume rather than the severity or the confirmed targeted use; the fact that Arista pre-patched its Hosted and Dedicated environments before publishing indicates how seriously the vendor assessed the risk. On-premises operators should patch immediately and assume compromise until triage proves otherwise.
Remediation
- Follow the CISA KEV required action: apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 risk-based patching guidance and CISA's Forensics Triage Requirements, and discontinue use of the product if mitigations are unavailable. The KEV due date is 2026-07-30.
- Patch on-premises VeloCloud Orchestrator per Arista security advisory 0144. Affected builds run from 5.2.0 up to but not including 5.2.3.14, from 6.1.0 up to but not including 6.1.3.4, from 6.4.0 up to but not including 6.4.2.4, plus 7.0.0 — upgrade to 5.2.3.14, 6.1.3.4, 6.4.2.4, or the fixed 7.0 build. Hosted and Dedicated VCO instances were already patched by Arista and need no customer action.
- Apply the mitigation described in the Arista advisory where immediate patching is not possible, and block external access to the internal functionality by placing the VCO management interface behind a firewall or reverse proxy that only permits known administrative sources.
- Perform forensic triage on the VCO host in line with CISA's guidance: review web and application logs for requests to internal-only routes, check process accounting for unexpected shell children of the orchestrator service, and look for new files, cron entries, or accounts, since active exploitation is confirmed and successful exploitation yields command execution.
- As long-term hardening against OS command injection (CWE-78), avoid invoking shell commands from application code, use language-level APIs or parameterised process execution with argument arrays instead of shell strings, and enforce allowlist validation on any input that reaches a process invocation — combined with network segmentation so that internal-only endpoints are unreachable from untrusted networks by design.
Technical Details
The root cause of CVE-2026-16812 is that VeloCloud Orchestrator on-premises exposes functionality intended for internal use only to remote callers, and that functionality leads to operating system command execution on the VCO host (CWE-78). OS command injection arises when a command string is assembled from externally influenced input without neutralising shell metacharacters, so the attacker's data is interpreted as command syntax and executes with the privileges of the calling service. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H shows why the score reaches 10.0: the request arrives over the network (AV:N) with no special preconditions (AC:L), no privileges (PR:N), and no user interaction (UI:N), while the impact on confidentiality, integrity, and availability is High across the board. The S:C metric records that the compromise crosses a security boundary — the orchestrator manages other systems, so code execution there affects resources beyond the vulnerable component. Because the exposed path was never meant to be reachable from outside, no authentication or authorisation gate stands between an internet-facing VCO and privileged internal operations.
Frequently Asked Questions
Is CVE-2026-16812 being actively exploited?
Yes. Arista states in its own advisory that the vulnerability was discovered externally and is known to be actively exploited, and CISA lists CVE-2026-16812 in its Known Exploited Vulnerabilities catalog with a remediation deadline of 2026-07-30. Ransomware usage is currently marked as Unknown, and the EPSS score of 0.88% reflects limited observed mass scanning rather than any doubt about real-world exploitation.
What products are affected by CVE-2026-16812?
The vulnerability affects on-premises Arista VeloCloud Orchestrator (VCO) in versions 5.2.0 up to but not including 5.2.3.14, 6.1.0 up to but not including 6.1.3.4, 6.4.0 up to but not including 6.4.2.4, and version 7.0.0. Hosted and Dedicated VCO versions were patched by Arista in advance of the advisory and are not exposed.
How do I fix CVE-2026-16812?
Upgrade on-premises VCO to 5.2.3.14, 6.1.3.4, 6.4.2.4, or the fixed 7.0 build as described in Arista security advisory 0144, and apply the vendor's interim mitigation if you cannot patch at once. Because the flaw allows command execution on the VCO host, also restrict network access to the management interface and run forensic triage on the orchestrator before returning it to normal operation.
How severe is CVE-2026-16812?
CVE-2026-16812 is rated Critical with a CVSS 3.1 base score of 10.0, the maximum possible value. It combines unauthenticated remote exploitation with high impact on confidentiality, integrity, and availability and a changed scope, meaning a single request can compromise the orchestrator and reach the SD-WAN infrastructure it manages; its EPSS score sits in the 56th percentile, but the confirmed in-the-wild exploitation makes immediate action necessary regardless.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.