Arista has patched a maximum-severity, CVSS 10.0 command injection vulnerability in on-premises deployments of VeloCloud Orchestrator (VCO) — the centralized management plane for VeloCloud SD-WAN fleets — after confirming it is being actively exploited. CISA added CVE-2026-16812 to the Known Exploited Vulnerabilities catalog on July 27, 2026, giving federal civilian agencies until July 30 to remediate under Binding Operational Directive 22-01. Arista has not disclosed who is behind the attacks, when they began, or the specific exploitation technique — only that the flaw was discovered externally and is already being used against real deployments.

What’s Broken

VeloCloud Orchestrator is the web-based control plane administrators use to configure, monitor, and push policy to VeloCloud SD-WAN edge devices across an organization’s WAN. CVE-2026-16812 is an unauthenticated OS command injection flaw that lets a remote attacker reach privileged internal functionality that was never meant to be exposed outside the orchestrator itself. No VCO tenant or operator credentials are required — network access to the VCO web interface is sufficient to trigger command execution on the underlying host.

The advisory’s most unsettling detail is exposure by design: on-premises VCO deployments expose the vulnerable interface by default, and there is no supported configuration that fully removes that exposure short of network-layer access controls. This isn’t a case of a rarely-enabled feature being at fault — it’s a core management surface that ships reachable out of the box.

Successful exploitation compromises confidentiality, integrity, and availability of the orchestrator itself and, by extension, every edge device and WAN policy it manages. A compromised VCO is control-plane compromise for the whole SD-WAN fabric: an attacker with code execution on the orchestrator can rewrite routing and segmentation policy, intercept or redirect traffic across the WAN, and pivot into every site the orchestrator touches.

Impact

Affected: on-premises VeloCloud Orchestrator deployments only. Arista confirms VCO Hosted and Dedicated (Arista-managed) deployments were patched before the advisory was published and are not affected — this is squarely a self-hosted VCO problem.

Not affected / already fixed:

  • VCO 5.2.3.14 and later
  • VCO 6.1.3.4 and later
  • VCO 6.4.2.4 and later
  • VCO 7.0.0.1 and later

Any on-premises VCO instance running a version below these thresholds is exposed. Given the flaw requires no authentication and the management interface is internet-reachable in many real-world SD-WAN deployments, the exploitability bar is low and the blast radius — every edge and every WAN policy under that orchestrator’s control — is large. CISA’s KEV listing tracks this as confirmed active exploitation, not a theoretical risk.

CVE-2026-16812 landed in the same July 27 KEV batch as a Fortinet FortiOS SSL-VPN flaw, underscoring that edge/WAN management infrastructure is having an active week as an attacker target.

Mitigation

  1. Patch immediately. Upgrade on-premises VCO to 5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1 or later, whichever release track you’re on. There is no supported configuration workaround that closes the hole — patching is the fix.
  2. Restrict VCO web-interface access to administrative networks only. Because the vulnerable functionality is exposed by default, network-layer isolation (firewall rules, VPN-only access, allowlisting) is the only mitigating control available before you patch.
  3. Monitor for connections from known-malicious infrastructure and cross-reference VCO access logs against current threat-intel indicator feeds.
  4. Review recent administrator activity on affected orchestrators for unexplained configuration changes, new admin accounts, or policy pushes that don’t map to known change requests — signs of prior compromise before the patch was applied.
  5. Federal agencies: BOD 22-01 sets a hard July 30, 2026 deadline. Everyone else should treat that date as the practical ceiling too, given confirmed active exploitation.

References