# CVE-2026-16812 — Critical Unauthenticated OS Command Injection in Arista VeloCloud Orchestrator Actively Exploited

> CVE-2026-16812 is a CVSS 10.0 unauthenticated OS command injection (CWE-78) in Arista VeloCloud Orchestrator (VCO) On-Prem. A remote attacker with network access to the VCO web interface can reach privileged internal functionality designed for internal use only, execute arbitrary OS commands on the VCO host, and compromise the confidentiality, integrity, and availability of the orchestrator, its managed data, and potentially downstream VeloCloud Edge devices. Active exploitation has been confirmed by Arista and CISA, which added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on July 27, 2026, with a federal mitigation deadline of July 30, 2026.

- **Published:** 2026-08-03T00:00:00Z
- **Last reviewed:** 2026-08-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1851
- **ID:** TL-2026-1851
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-16812

## Description

CVE-2026-16812 is a maximum-severity, pre-authentication OS command injection vulnerability in the Arista VeloCloud Orchestrator (VCO) On-Prem product, tracked internally as Arista BUG-1901675. The vulnerability resides in a privileged internal API endpoint that was designed for trusted internal use only but is incorrectly exposed through the VCO web interface on all on-premises deployments. VCO is exposed by default — there is no configuration option that can prevent this exposure, and no tenant or operator credentials are required for exploitation. An attacker needs only network access to the VCO web interface, which is typically reachable on the standard management ports.

The command injection mechanism operates through crafted HTTP requests containing OS command payloads embedded in request parameters. The advisory specifically highlights that exploitation attempts manifest as requests with unusual URL-like path components, encoded characters, references to local or internal services, or abnormally high request rates. Successful injection allows the attacker to execute arbitrary OS commands on the underlying VCO host with the privileges of the VCO service process, which has broad access to the orchestrator's configuration, device inventory, database, credentials, certificates, and cryptographic key material.

Post-exploitation capabilities include: exfiltration of device configurations and credentials from the VCO database; creation of archive files containing stolen data; establishment of outbound HTTP/HTTPS connections for command-and-control (C2) communication; credential harvesting from stored configuration data; lateral movement to managed VeloCloud Edge devices across the SD-WAN fabric; and modification of the orchestrator's configuration to maintain persistent access. The advisory warns that patching alone does not remove an existing compromise — organizations must rotate credentials, review administrator activity, validate managed device states, and restore affected instances from trusted sources.

Three attacker IP addresses have been observed conducting exploitation: 8.19.75.217 (hosted on Level 3 / AS3356, geolocated to Oldsmar, Florida) and 206.72.242.124 / 206.72.242.162 (both hosted on Dobson Technologies / AS30029, Oklahoma City, Oklahoma — sharing the same /24 subnet, indicating a common attacker infrastructure cluster). No threat actor attribution has been publicly established. The vulnerability was discovered externally and confirmed as actively exploited prior to the availability of patches. Arista has released fixed versions across all supported release trains, and hosted/dedicated VCO cloud instances were patched before the public advisory.

CISA added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog on July 27, 2026, with a required mitigation deadline of July 30, 2026, for U.S. federal civilian agencies per Binding Operational Directive 22-01 (BOD 26-04). CISA's SSVC assessment rates exploitation as Active, Automatable (Yes), and Technical Impact as Total. The vulnerability was added to the KEV catalog alongside CVE-2025-68686 (Fortinet FortiOS information disclosure), suggesting coordinated exploitation activity across multiple enterprise infrastructure products during the same period.

Affected versions: VCO 5.2.x prior to 5.2.3.14, VCO 6.1.x prior to 6.1.3.4, VCO 6.4.x prior to 6.4.2.4, and VCO 7.0.x prior to 7.0.0.1. The product was originally developed by VMware VeloCloud, acquired by Broadcom, and subsequently acquired by Arista Networks. The VeloCloud Gateway and Edge products are not directly vulnerable to this CVE but can be compromised as a secondary target through a compromised orchestrator.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1027 Obfuscated Files or Information
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1485 Data Destruction

## Sources

- [Arista Security Advisory 0144](https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144)
- [NVD — CVE-2026-16812](https://nvd.nist.gov/vuln/detail/CVE-2026-16812)
- [CISA Known Exploited Vulnerabilities — CVE-2026-16812](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812)
- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [BleepingComputer — Arista patches VeloCloud Orchestrator zero-day exploited in attacks](https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/)
- [SecurityWeek — Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day](https://www.securityweek.com/critical-arista-velocloud-orchestrator-vulnerability-exploited-as-zero-day/)
- [The Hacker News — Attackers Exploit Arista VeloCloud Orchestrator Zero-Day](https://thehackernews.com/2026/07/attackers-exploit-arista-velocloud.html)
- [The Register — Arista patches actively exploited VeloCloud bug](https://www.theregister.com/security/2026/07/28/arista-patches-actively-exploited-velocloud-bug-as-cisa-puts-admins-on-the-clock/5279414)
- [GBHackers — Hackers Exploit Critical Arista VeloCloud Flaw](https://gbhackers.com/hackers-exploit-critical-arista-velocloud-flaw/)
- [GitHub Security Advisory — GHSA-f2cp-q2qv-6563](https://github.com/advisories/GHSA-f2cp-q2qv-6563)
- [Tenable — CVE-2026-16812](https://www.tenable.com/cve/CVE-2026-16812)
- [Security Affairs — CISA adds Arista VeloCloud and Fortinet FortiOS flaws to KEV](https://securityaffairs.com/196130/security/u-s-cisa-adds-arista-velocloud-orchestrator-and-fortinet-fortios-flaws-to-its-known-exploited-vulnerabilities-catalog.html)
- [DEV Community — VeloCloud Orchestrator CVE-2026-16812 Technical Analysis](https://dev.to/anoymask/velocloud-orchestrator-cve-2026-16812-unauthenticated-os-command-injection-actively-exploited-ml0)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1851