Arista rates it 10.0 Critical on CVSS v3.1 and v4.0 in security advisory 0144 and says it is known to be actively exploited. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 27 July 2026, the day Arista published the advisory.
What it allows
Arista classes the flaw as OS command injection (CWE-78) and says it may allow a remote attacker to access privileged internal functionality and impact the VCO host. The advisory gives the attack vector as network, with no privileges and no user interaction needed. The score of 10.0 reflects that. Arista adds that the issue "was discovered externally and is known to be actively exploited". It does not name the attackers or say how many systems were hit.
Arista also says VCO "is exposed by default" and that "there is no configuration that can prevent the exposure". You cannot rely on a setting to make a build safe. The fix is the update, plus limiting who can reach the web interface.
This is the first of three exploited VCO flaws since July 2026. The second is the CVE-2026-93952 improper input validation flaw, and the third is the CVE-2026-114625 SQL injection flaw. The builds that fix this one are too old for the later two, so check the table below against all three. We compare all three side by side in 3 Exploited Arista VeloCloud Flaws in 88 Days.
What our X and dark web checks showed on 25 October 2026. X: 14 distinct posts name CVE-2026-16812, and 12 of them came between 27 July and 2 August, right after the advisory and KEV entry of 27 July. Dark web monitoring through Blackhole: 13 posts mention CVE-2026-16812 (Telegram 12, one forum), all between 27 and 29 July, and 95 posts mention VeloCloud since 25 July in total. These are aggregate counts, and we did not run or link any code.
Who is affected
Affected per Arista advisory 0144, by release train:
5.2.x before 5.2.3.14. Fixed in 5.2.3.14 and later.
6.1.x before 6.1.3.4. Fixed in 6.1.3.4 and later.
6.4.x before 6.4.2.4. Fixed in 6.4.2.4 and later.
7.0.x before 7.0.0.1. The resolution section of the advisory lists no 7.0 release.
Arista says end of support versions have not been assessed. Hosted and Dedicated VCO were affected and, in Arista's words, are being actively patched. Revision 1.1 of 3 August 2026 added VCO Hosted to the list.
These fixed builds only close this flaw. The later advisories need newer builds: 5.2.3.16 or 6.4.2.8 for CVE-2026-93952, and 5.2.3.18, 6.1.3.10 or 6.4.2.12 for CVE-2026-114625.
Timeline
- 27 Jul 2026
Arista publishes security advisory 0144 for CVE-2026-16812 and says the issue was discovered externally and is known to be actively exploited.
- 27 Jul 2026
CISA adds CVE-2026-16812 to its KEV catalog with a due date of 30 Jul 2026. The entry marks forensic triage as required and known ransomware use as Unknown.
- 3 Aug 2026
Arista advisory revision 1.1 adds VCO Hosted to the affected products.
- 22 Sep 2026
Arista advisory 0183 (CVE-2026-93952) follows, 57 days after the KEV entry for this flaw.
- 22 Oct 2026
Arista advisory 0199 (CVE-2026-114625) is published, the third exploited VCO flaw since July.
What to do
-
Find your VCO build
Read the version in your own deployment and compare it with the affected list on this page. Do not stop at the July builds: the later advisories need newer ones.
-
Update to the latest fixed build
Move to the build that fixes all three flaws in your train, not only 5.2.3.14, 6.1.3.4 or 6.4.2.4. The versions are on the pages for CVE-2026-93952 and CVE-2026-114625.
-
Restrict the web interface
Arista advises limiting access to the VCO web interface to trusted administrative networks, because the exposure cannot be configured away.
-
Watch for abuse
Arista advises monitoring for access from known malicious source IPs and for unexpected outbound activity from the VCO host.
-
Review admin activity
Review recent administrator activity for changes nobody made. CISA marks forensic triage as required for this entry, so keep logs before you rebuild.
What Brandefense can do
- Watch your stack for exploited flaws
Name the vendors and products you run, and Brandefense alerts you when a CVE in them is exploited.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
Is CVE-2026-16812 being exploited?
Yes. Arista's advisory 0144 says the issue was discovered externally and is known to be actively exploited. It does not name the attackers.
When was CVE-2026-16812 added to the CISA KEV catalog?
CISA added it on 27 July 2026 with a due date of 30 July 2026. The entry marks forensic triage as required and lists known ransomware campaign use as Unknown. Its required action points to vendor mitigations and CISA's BOD 26-04 guidance.
Which VeloCloud Orchestrator builds fix CVE-2026-16812?
5.2.3.14, 6.1.3.4 and 6.4.2.4 and later in their trains. The advisory lists no fixed 7.0 release. Later flaws need newer builds, so check the affected list on this page.
Does the attacker need a login?
No. Arista's CVSS vector sets privileges required to none, with network access and no user interaction.
Can a setting block the attack?
No. Arista says VCO is exposed by default and no configuration can prevent the exposure. Limit access to the web interface and update.
Is this the same flaw as CVE-2026-93952 or CVE-2026-114625?
No. They are separate flaws in separate advisories, 0183 and 0199. See the CVE-2026-93952 page and the CVE-2026-114625 page.
