Arista patches critical command injection flaw in VeloCloud Orchestrator exploited in attacks

As reported by Bleeping Computer, Arista released a patch for a critical command injection vulnerability affecting on-premises VeloCloud Orchestrator (VCO) deployments. This flaw, identified as CVE-2026-16812, carries the maximum severity score of 10.0 and is reportedly being actively exploited in the wild.

The unauthenticated OS command injection vulnerability allows remote attackers to execute arbitrary commands with privileged access on the VCO, potentially compromising the confidentiality, integrity, and availability of the orchestrator and its managed data. Exploitation requires only network access to the VCO web interface, without the need for any credentials. Arista has confirmed that this vulnerability is actively exploited, though details on the attackers and the timeline of attacks remain undisclosed. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog, mandating U.S. federal agencies to address it by July 30, 2026. Affected versions include specific releases of VCO 5.2.x, 6.1.x, 6.4.x, and 7.0.x. Arista advises customers to restrict network access to the VCO web interface and monitor for suspicious activity, including connections from known malicious IP addresses like 8.19.75.217, 206.72.242.124, and 206.72.242.162.

Source: Bleeping Computer