CVE-2026-16812 — Critical Unauthenticated OS Command Injection in Arista VeloCloud Orchestrator Actively Exploited — Threadlinqs Intelligence
As of 2026-08-03, CVE-2026-16812 — Critical Unauthenticated OS Command Injection in Arista VeloCloud Orchestrator Actively Exploited is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 6 indicators of compromise.
Threat ID: TL-2026-1851 · Severity: CRITICAL · CVSS: 10 · Status: ACTIVE · Category: VULNERABILITY
CVE-2026-16812 is a CVSS 10.0 unauthenticated OS command injection (CWE-78) in Arista VeloCloud Orchestrator (VCO) On-Prem. A remote attacker with network access to the VCO web interface can reach
CVE-2026-16812 is a maximum-severity, pre-authentication OS command injection vulnerability in the Arista VeloCloud Orchestrator (VCO) On-Prem product, tracked internally as Arista BUG-1901675. The vulnerability resides in a privileged internal API endpoint that was designed for trusted internal use only but is incorrectly exposed through the VCO web interface on all on-premises deployments. VCO is exposed by default — there is no configuration option that can prevent this exposure, and no tenant or operator credentials are required for exploitation. An attacker needs only network access to the VCO web interface, which is typically reachable on the standard management ports.
The command injection mechanism operates through crafted HTTP requests containing OS command payloads embedded in request parameters. The advisory specifically highlights that exploitation attempts manifest as requests with unusual URL-like path components, encoded characters, references to local or internal services, or abnormally high request rates. Successful injection allows the attacker to execute arbitrary OS commands on the underlying VCO host with the privileges of the VCO service process, which has broad access to the orchestrator's configuration, device inventory, database, credentials, certificates, and cryptographic key material.
Post-exploitation capabilities include: exfiltration of device configurations and credentials from the VCO database; creation of archive files containing stolen data; establishment of outbound HTTP/HTTPS connections for command-and-control (C2) communication; credential harvesting from stored configuration data; lateral movement to managed VeloCloud Edge devices across the SD-WAN fabric; and modification of the orchestrator's configuration to maintain persistent access. The advisory warns that patching alone does not remove an existing compromise — organizations must rotate credentials, review administrator activity, validate managed device states, and restore affected instances from trusted sources.
Three attacker IP addresses have been observed conducting exploitation: 8.19.75.217 (hosted on Level 3 / AS3356, geolocated to Oldsmar, Florida) and 206.72.242.124 / 206.72.242.162 (both hosted on Dobson Technologies / AS30029, Oklahoma City, Oklahoma — sharing the same /24 subnet, indicating a common attacker infrastructure cluster). No threat actor attribution has been publicly established. The vulnerability was discovered externally and confirmed as actively exploited prior to the availability of patches. Arista has released fixed versions across all supported release trains, and hosted/dedicated VCO cloud instances were patched before the public advisory.
CISA added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog on July 27, 2026, with a required mitigation deadline of July 30, 2026, for U.S. federal civilian agencies per Binding Operational Directive 22-01 (BOD 26-04). CISA's SSVC assessment rates exploitation as Active, Automatable (Yes), and Technical Impact as Total. The vulnerability was added to the KEV catalog alongside CVE-2025-68686 (Fortinet FortiOS information disclosure), suggesting coordinated exploitation activity across multiple enterprise infrastructure products during the same period.
Affected versions: VCO 5.2.x prior to 5.2.3.14, VCO 6.1.x prior to 6.1.3.4, VCO 6.4.x prior to 6.4.2.4, and VCO 7.0.x prior to 7.0.0.1. The product was originally developed by VMware VeloCloud, acquired by Broadcom, and subsequently acquired by Arista Networks. The VeloCloud Gateway and Edge products are not directly vulnerable to this CVE but can be compromised as a secondary target through a compromised orchestrator.
Target sectors: telecoms, government administration, financial services, health, technology, manufacturing, energy, retail, education, transport
Target regions: North America, Europe, Asia Pacific, Middle East, Latin America
Detections & IOCs
As of 2026-08-24, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 6 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-16812, T1592, T1590, T1583, T1190, T1059, T1505, T1027, T1552, T1082, T1046
