Threat reportVulnerabilityTL-2026-1851
CVE-2026-16812 — Critical Unauthenticated OS Command Injection in Arista VeloCloud Orchestrator Actively Exploited
CVE-2026-16812 (TL-2026-1851), also tracked as BUG-1901675, is a critical-severity software vulnerability scored CVSS 10, first published 2026-08-03. It has no confirmed attribution, affects Arista Networks VeloCloud Orchestrator (VCO) On-Prem, references 1 CVE (CVE-2026-16812), maps to 15 MITRE ATT&CK techniques (T1005, T1021, T1027), and is covered by 9 detection rules and 6 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-1851
- Threat ID
- TL-2026-1851
- Also known as
- BUG-1901675
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- telecoms, government administration, financial services, health, technology, manufacturing, energy, retail, education, transport
- Target regions
- North America, Europe, Asia Pacific, Middle East, Latin America
- Detection rules
- 9
- Indicators of compromise
- 6
How CVE-2026-16812 works
CVE-2026-16812 is a CVSS 10.0 unauthenticated OS command injection (CWE-78) in Arista VeloCloud Orchestrator (VCO) On-Prem. A remote attacker with network access to the VCO web interface can reach privileged internal functionality designed for internal use only, execute arbitrary OS commands on the VCO host, and compromise the confidentiality, integrity, and availability of the orchestrator, its managed data, and potentially downstream VeloCloud Edge devices. Active exploitation has been confirmed by Arista and CISA, which added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on July 27, 2026, with a federal mitigation deadline of July 30, 2026.
CVE-2026-16812 is a maximum-severity, pre-authentication OS command injection vulnerability in the Arista VeloCloud Orchestrator (VCO) On-Prem product, tracked internally as Arista BUG-1901675. The vulnerability resides in a privileged internal API endpoint that was designed for trusted internal use only but is incorrectly exposed through the VCO web interface on all on-premises deployments. VCO is exposed by default — there is no configuration option that can prevent this exposure, and no tenant or operator credentials are required for exploitation. An attacker needs only network access to the VCO web interface, which is typically reachable on the standard management ports.
The command injection mechanism operates through crafted HTTP requests containing OS command payloads embedded in request parameters. The advisory specifically highlights that exploitation attempts manifest as requests with unusual URL-like path components, encoded characters, references to local or internal services, or abnormally high request rates. Successful injection allows the attacker to execute arbitrary OS commands on the underlying VCO host with the privileges of the VCO service process, which has broad access to the orchestrator's configuration, device inventory, database, credentials, certificates, and cryptographic key material.
Post-exploitation capabilities include: exfiltration of device configurations and credentials from the VCO database; creation of archive files containing stolen data; establishment of outbound HTTP/HTTPS connections for command-and-control (C2) communication; credential harvesting from stored configuration data; lateral movement to managed VeloCloud Edge devices across the SD-WAN fabric; and modification of the orchestrator's configuration to maintain persistent access. The advisory warns that patching alone does not remove an existing compromise — organizations must rotate credentials, review administrator activity, validate managed device states, and restore affected instances from trusted sources.
Three attacker IP addresses have been observed conducting exploitation: 8.19.75.217 (hosted on Level 3 / AS3356, geolocated to Oldsmar, Florida) and 206.72.242.124 / 206.72.242.162 (both hosted on Dobson Technologies / AS30029, Oklahoma City, Oklahoma — sharing the same /24 subnet, indicating a common attacker infrastructure cluster). No threat actor attribution has been publicly established. The vulnerability was discovered externally and confirmed as actively exploited prior to the availability of patches. Arista has released fixed versions across all supported release trains, and hosted/dedicated VCO cloud instances were patched before the public advisory.
CISA added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog on July 27, 2026, with a required mitigation deadline of July 30, 2026, for U.S. federal civilian agencies per Binding Operational Directive 22-01 (BOD 26-04). CISA's SSVC assessment rates exploitation as Active, Automatable (Yes), and Technical Impact as Total. The vulnerability was added to the KEV catalog alongside CVE-2025-68686 (Fortinet FortiOS information disclosure), suggesting coordinated exploitation activity across multiple enterprise infrastructure products during the same period.
Affected versions: VCO 5.2.x prior to 5.2.3.14, VCO 6.1.x prior to 6.1.3.4, VCO 6.4.x prior to 6.4.2.4, and VCO 7.0.x prior to 7.0.0.1. The product was originally developed by VMware VeloCloud, acquired by Broadcom, and subsequently acquired by Arista Networks. The VeloCloud Gateway and Edge products are not directly vulnerable to this CVE but can be compromised as a secondary target through a compromised orchestrator.
MITRE ATT&CK techniques used in TL-2026-1851
Collection
T1005 Data from Local System; T1213 Data from Information Repositories
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information
Discovery
T1046 Network Service Discovery; T1082 System Information Discovery
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol
Initial Access
T1190 Exploit Public-Facing Application
Impact
Persistence
T1505 Server Software Component
Credential Access
Resource Development
Reconnaissance
T1590 Gather Victim Network Information; T1592 Gather Victim Host Information
Affected products and versions in CVE-2026-16812
- Arista Networks — VeloCloud Orchestrator (VCO) On-Prem
Vulnerable versions: 5.2.0 to 5.2.3.13; 6.1.0 to 6.1.3.3; 6.4.0 to 6.4.2.3; 7.0.0
Fixed in: 5.2.3.14; 6.1.3.4; 6.4.2.4; 7.0.0.1 - Arista Networks — VeloCloud Orchestrator (VCO) Hosted
Fixed in: Patched before advisory publication - Arista Networks — VeloCloud Orchestrator (VCO) Dedicated
Fixed in: Patched before advisory publication
Remediation for CVE-2026-16812
Patches
- VCO 5.2.3.14 and later
- VCO 6.1.3.4 and later
- VCO 6.4.2.4 and later
- VCO 7.0.0.1 and later
- Contact Arista TAC for end-of-support version guidance
Immediate actions
- Upgrade VCO to fixed versions: 5.2.3.14+, 6.1.3.4+, 6.4.2.4+, or 7.0.0.1+
- Block attacker IP addresses 8.19.75.217, 206.72.242.124, and 206.72.242.162 at network perimeter
- Restrict VCO web interface access to trusted administrative management networks only
- Preserve all VCO web access logs, backend application logs, system logs, database logs, and file-system timestamps before remediation
Workarounds
- No configuration can fully eliminate exposure — patching is the only complete fix
- Restrict VCO web UI to trusted administrative networks as defense-in-depth
- Monitor for outbound HTTP/HTTPS from VCO host as post-exploitation indicator
Longer-term hardening
- Rotate all credentials for managed VeloCloud Edge devices
- Review all administrator activity for unauthorized changes
- Validate managed device states and configurations
- Restore or replace compromised orchestrator instances from trusted sources
- Implement network segmentation isolating management infrastructure from general corporate networks
- Deploy behavioral detection monitoring for VCO outbound traffic and anomalous web requests
- Establish robust patch management SLA for critical infrastructure appliances
CVEs associated with CVE-2026-16812
Weaknesses (CWE) in CVE-2026-16812
Timeline of CVE-2026-16812
- Vulnerability was discovered externally and confirmed to be actively exploited prior to the advisory publication date. Three attacker IPs (8.19.75.217, 206.72.242.124, 206.72.242.162) identified conducting exploitation attempts. Exact date of first exploitation not disclosed.
- BleepingComputer reports on the actively exploited zero-day, noting the short 3-day CISA remediation window and the cascading risk to VeloCloud Edge devices.
- GitHub Security Advisory GHSA-f2cp-q2qv-6563 published for CVE-2026-16812. No public PoC exploit code available.
- NVD publishes CVE-2026-16812 detail with CVSS 10.0 scores for both v3.1 and v4.0. CWE-78 classification confirmed.
- CISA adds CVE-2026-16812 to the Known Exploited Vulnerabilities (KEV) catalog with a federal mitigation deadline of July 30, 2026, alongside CVE-2025-68686 (Fortinet FortiOS). CISA SSVC assessment: Active exploitation, Automatable, Total Technical Impact.
- Arista publishes Security Advisory 0144 disclosing CVE-2026-16812, a CVSS 10.0 unauthenticated OS command injection in VeloCloud Orchestrator On-Prem, tracked as BUG-1901675. Confirms active exploitation in the wild and publishes three attacker IP addresses.
- NIST adds CPE configurations for affected VCO versions via initial NVD analysis, enabling automated vulnerability scanning.
- SecurityWeek, The Hacker News, and The Register publish detailed analysis of the vulnerability. Security researchers publish MITRE ATT&CK mappings and attack phase progression models. CISA issues formal alert confirming both KEV additions.
- CISA federal mitigation deadline for U.S. FCEB agencies per BOD 22-01. Agencies must apply patches or discontinue use of affected VCO instances.
- GBHackers reports ongoing exploitation activity. Threat remains active with no public threat actor attribution. No public PoC exploit code released, keeping barrier to entry elevated for less sophisticated attackers.
Sources cited for CVE-2026-16812
- Arista Security Advisory 0144
- NVD — CVE-2026-16812
- CISA Known Exploited Vulnerabilities — CVE-2026-16812
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
- BleepingComputer — Arista patches VeloCloud Orchestrator zero-day exploited in attacks
- SecurityWeek — Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day
- The Hacker News — Attackers Exploit Arista VeloCloud Orchestrator Zero-Day
- The Register — Arista patches actively exploited VeloCloud bug
- GBHackers — Hackers Exploit Critical Arista VeloCloud Flaw
- GitHub Security Advisory — GHSA-f2cp-q2qv-6563
- Tenable — CVE-2026-16812
- Security Affairs — CISA adds Arista VeloCloud and Fortinet FortiOS flaws to KEV
- DEV Community — VeloCloud Orchestrator CVE-2026-16812 Technical Analysis
Detection coverage for TL-2026-1851
As of 2026-08-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1851 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.