CVE-2026-16812 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-07-27

Added to CISA KEV: 2026-07-27 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV and confirmed actively exploited. Review VCO web interface access logs for requests from unknown/malicious source IPs, inspect for unexpected outbound network activity from the VCO host, review administrator activity for unauthorized changes, and verify system/file integrity for web shells or backdoors.
IMMEDIATE PATCHING: Upgrade to a fixed release without delay - VCO 5.2.3.14+, 6.1.3.4+, 6.4.2.4+, or 7.0.0.1+. For unsupported release trains, contact Arista TAC for upgrade options. Patching is the only fully effective remediation.
INTERIM MITIGATION: Restrict VCO web interface access to trusted administrative networks only (firewall/ACL), monitor for accesses from known malicious source IPs, and enable enhanced logging/alerting on the VCO host.
Patch Priority: EMERGENCY / P0 - CVSS 10.0, unauthenticated RCE, actively exploited, CISA KEV listed, and controls critical SD-WAN infrastructure. Treat as top-priority incident and assume potential compromise if exposed.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-16812 is a critical OS command injection vulnerability (CVSS 10.0) affecting on-premises deployments of the Arista VeloCloud Orchestrator (VCO). The flaw stems from the product's failure to properly neutralize externally-influenced input when constructing OS commands, allowing a remote, unauthenticated attacker to inject and execute arbitrary commands on the underlying host. This vulnerability is significant because it provides full control over the SD-WAN orchestrator, potentially compromising the entire enterprise network managed by the affected VCO.

Exploitation

Active Exploitation: The vulnerability is confirmed to be under active exploitation in the wild as of July 27, 2026.
Threat Actors/Campaigns: CISA has issued an emergency order requiring federal agencies to patch, signaling the high risk associated with ongoing malicious activity.
Proof-of-Concept/Exploits: Public awareness of the exploit is high, and the simplicity of the injection method has led to widespread availability of exploitation techniques.
Attack Prerequisites:

- Network Access: The vulnerability is remotely exploitable over the network. - Authentication: No authentication is required to execute the exploit. - User Interaction: No user interaction is necessary to compromise the system.

Affected Products & Patches

Affected Versions: On-premises instances of Arista VeloCloud Orchestrator (VCO).
Patches/Hotfixes: Arista has released security updates to remediate this vulnerability; users are directed to the official Arista support portal to apply the necessary patches.
Mitigations/Workarounds: Given the critical nature of the vulnerability and reports of active exploitation, applying the official security patch is the only recommended course of action. Internet-facing VCO instances should be isolated or restricted by firewall rules if immediate patching is not possible.

Impact

System Access: Successful exploitation grants an attacker full remote code execution capabilities with the privileges of the VCO host, effectively providing "root" or administrative control over the appliance.
Business Risk: For internet-facing deployments, this vulnerability poses a catastrophic risk, as it allows attackers to bypass security boundaries, potentially intercepting or manipulating data traversing the enterprise WAN, disrupting connectivity, and gaining a persistent foothold within the organization's infrastructure.