Quick links
Press Enter to search, Esc to close
Exploited vulnerability
An OS command injection flaw (CWE-78) in Arista VeloCloud Orchestrator (VCO), the management server for VeloCloud SD-WAN.
In short
CVE-2026-16812 is an OS command injection flaw (CWE-78) in Arista VeloCloud Orchestrator (VCO), the management server for VeloCloud SD-WAN. Arista rates it 10.0 Critical on CVSS v3.1 and v4.0 in security advisory 0144 and says it is known to be actively exploited. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 27 July 2026, the day Arista published the advisory.
Arista classes the flaw as OS command injection (CWE-78) and says it may allow a remote attacker to access privileged internal functionality and impact the VCO host. The advisory gives the attack vector as network, with no privileges and no user interaction needed. The score of 10.0 reflects that. Arista adds that the issue "was discovered externally and is known to be actively exploited". It does not name the attackers or say how many systems were hit.
Arista also says VCO "is exposed by default" and that "there is no configuration that can prevent the exposure". You cannot rely on a setting to make a build safe. The fix is the update, plus limiting who can reach the web interface.
This is the first of three exploited VCO flaws since July 2026. The second is the CVE-2026-93952 improper input validation flaw, and the third is the CVE-2026-114625 SQL injection flaw. The builds that fix this one are too old for the later two, so check the table below against all three. We compare all three side by side in 3 Exploited Arista VeloCloud Flaws in 88 Days.
What our X and dark web checks showed on 25 October 2026. X: 14 distinct posts name CVE-2026-16812, and 12 of them came between 27 July and 2 August, right after the advisory and KEV entry of 27 July. Dark web monitoring through THANOS: 13 posts mention CVE-2026-16812 (Telegram 12, one forum), all between 27 and 29 July, and 95 posts mention VeloCloud since 25 July in total. These are aggregate counts, and we did not run or link any code.
Affected per Arista advisory 0144, by release train:
5.2.x before 5.2.3.14. Fixed in 5.2.3.14 and later.
6.1.x before 6.1.3.4. Fixed in 6.1.3.4 and later.
6.4.x before 6.4.2.4. Fixed in 6.4.2.4 and later.
7.0.x before 7.0.0.1. The resolution section of the advisory lists no 7.0 release.
Arista says end of support versions have not been assessed. Hosted and Dedicated VCO were affected and, in Arista's words, are being actively patched. Revision 1.1 of 3 August 2026 added VCO Hosted to the list.
These fixed builds only close this flaw. The later advisories need newer builds: 5.2.3.16 or 6.4.2.8 for CVE-2026-93952, and 5.2.3.18, 6.1.3.10 or 6.4.2.12 for CVE-2026-114625.
Arista publishes security advisory 0144 for CVE-2026-16812 and says the issue was discovered externally and is known to be actively exploited.
CISA adds CVE-2026-16812 to its KEV catalog with a due date of 30 Jul 2026. The entry marks forensic triage as required and known ransomware use as Unknown.
Arista advisory revision 1.1 adds VCO Hosted to the affected products.
Arista advisory 0183 (CVE-2026-93952) follows, 57 days after the KEV entry for this flaw.
Arista advisory 0199 (CVE-2026-114625) is published, the third exploited VCO flaw since July.
Read the version in your own deployment and compare it with the affected list on this page. Do not stop at the July builds: the later advisories need newer ones.
Move to the build that fixes all three flaws in your train, not only 5.2.3.14, 6.1.3.4 or 6.4.2.4. The versions are on the pages for CVE-2026-93952 and CVE-2026-114625.
Arista advises limiting access to the VCO web interface to trusted administrative networks, because the exposure cannot be configured away.
Arista advises monitoring for access from known malicious source IPs and for unexpected outbound activity from the VCO host.
Review recent administrator activity for changes nobody made. CISA marks forensic triage as required for this entry, so keep logs before you rebuild.
Yes. Arista's advisory 0144 says the issue was discovered externally and is known to be actively exploited. It does not name the attackers.
CISA added it on 27 July 2026 with a due date of 30 July 2026. The entry marks forensic triage as required and lists known ransomware campaign use as Unknown. Its required action points to vendor mitigations and CISA's BOD 26-04 guidance.
5.2.3.14, 6.1.3.4 and 6.4.2.4 and later in their trains. The advisory lists no fixed 7.0 release. Later flaws need newer builds, so check the affected list on this page.
No. Arista's CVSS vector sets privileges required to none, with network access and no user interaction.
No. Arista says VCO is exposed by default and no configuration can prevent the exposure. Limit access to the web interface and update.
No. They are separate flaws in separate advisories, 0183 and 0199. See the CVE-2026-93952 page and the CVE-2026-114625 page.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
