Arista patches VeloCloud Orchestrator zero-day exploited in attacks
Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks.
Intelligence analysis by Llama
Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks. The vulnerability, tracked as CVE-2026-16812, is an unauthenticated OS command injection flaw with severity scores of 10.0.
Imagine you have a super powerful tool that can control many devices. If someone finds a way to hack into this tool, they can control all the devices it manages, which could be very bad. Arista has fixed a big security hole in this tool, but people who already hacked into it might still be able to control the devices.
Analysis
A Critical Vulnerability in VeloCloud Orchestrator
Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks. The vulnerability, tracked as CVE-2026-16812, is an unauthenticated OS command injection flaw with severity scores of 10.0, the maximum score that can be given to flaws.
VeloCloud Orchestrator, also known as VCO, is a centralized management platform used to configure, monitor, and manage VeloCloud SD-WAN deployments and associated edge devices. According to an Arista security advisory published Monday, the vulnerability allows remote attackers to access privileged functionality that was intended only for internal use and should not be remotely accessible.
"Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator," Arista warned.
The company says VCO is supposed to be exposed by default, with no configuration option that can prevent this exposure. Attackers only require network access to the VCO web interface, and no VCO tenant or operator credentials are needed to exploit the flaw.
Arista says CVE-2026-16812 was discovered externally and is known to be actively exploited, but has not shared when the attacks began, who is behind them, or how the vulnerability is being exploited.
Indicators of Compromise
While patches are being deployed, administrators should restrict access to the VCO web interface to administrative networks, monitor for connections from known malicious IP addresses, and review recent administrator activity for unusual changes.
Arista shared three IP addresses that were seen exploiting the vulnerability: 8.19.75.217, 206.72.242.124, and 206.72.242.162. Administrators are advised to block these IP addresses and review their logs for previous connections.
However, it is possible that devices could have been compromised from other IPs, so this list is not definitive. Organizations should review VCO logs for signs of exploitation, including unusual web requests containing encoded characters, URL-like path components, references to local or internal services, or abnormally high request rates, connections from known malicious IP addresses, unexpected outbound HTTP or HTTPS traffic from the VCO host, unauthorized configuration changes or privileged maintenance activity, unexpected command execution, file creation, database exports, or archive files, and suspicious access to VCO databases, configuration data, device inventories, credentials, certificates, or cryptographic keys.
If compromise is suspected, organizations should preserve all logs and filesystem timestamps before remediation. Potentially affected organizations should rotate credentials, review administrator activity, validate managed devices, and consider restoring or replacing compromised instances.
As successful exploitation can compromise both the orchestrator host and the data it manages, installing the security update may not be enough for systems that have already been breached. Arista warns that compromising a VeloCloud Orchestrator instance could also give attackers access to VeloCloud Edge devices as well.
Key points
- Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments.
- The vulnerability, tracked as CVE-2026-16812, is an unauthenticated OS command injection flaw with severity scores of 10.0.
- The vulnerability allows remote attackers to access privileged functionality that was intended only for internal use and should not be remotely accessible.
- Arista has shared three IP addresses that were seen exploiting the vulnerability: 8.19.75.217, 206.72.242.124, and 206.72.242.162.
- Organizations should review VCO logs for signs of exploitation and preserve all logs and filesystem timestamps before remediation.
Arista's quick response to patch the vulnerability and the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) addition of CVE-2026-16812 to its Known Exploited Vulnerabilities catalog demonstrate a commitment to addressing and mitigating the vulnerability. Additionally, the sharing of indicators of compromise and the provision of guidance on remediation efforts by Arista and CISA will help organizations protect themselves against potential attacks.
The fact that the vulnerability is being actively exploited and that Arista has not shared when the attacks began, who is behind them, or how the vulnerability is being exploited, suggests that the situation may be more complex and challenging to address than initially thought. Furthermore, the potential for attackers to gain access to VeloCloud Edge devices if a VeloCloud Orchestrator instance is compromised adds an additional layer of risk and complexity to the situation.
