Arista VeloCloud RCE (CVSS 10.0) Under Active Attack

Arista Networks disclosed on July 27, 2026 that a critical command injection vulnerability in on-premises VeloCloud Orchestrator (VCO) is being actively exploited in the wild. Tracked as CVE-2026-16812 with a maximum CVSS 10.0 score, the flaw allows remote unauthenticated attackers to execute arbitrary code on the VCO host. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on July 27, requiring Federal Civilian Executive Branch agencies to patch by July 30, 2026.

Vulnerability Details

Property	Value
CVE ID	CVE-2026-16812
CVSS v3.1	10.0 (Critical)
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High
CWE	CWE-78: OS Command Injection
CISA KEV	Added July 27, 2026
Vendor Advisory	Arista Security Advisory 0144

Affected Versions:

VCO 5.2.x prior to 5.2.3.14
VCO 6.1.x prior to 6.1.3.4
VCO 6.4.x prior to 6.4.2.4
VCO 7.0.x prior to 7.0.0.1

Fixed Versions:

VCO 5.2.3.14
VCO 6.1.3.4
VCO 6.4.2.4
VCO 7.0.0.1

Hosted and dedicated VCO instances were patched in advance by Arista and are not affected.

Impact Assessment

What's at risk:

Full compromise of the VeloCloud Orchestrator host
Access to all managed VeloCloud Edge devices
Network traffic interception and manipulation
Credential theft for SD-WAN infrastructure
Lateral movement into connected enterprise networks

Active exploitation confirmed: Arista stated the vulnerability was "externally discovered and known to be actively exploited." Three attacker IP addresses were identified:

8.19.75.217
206.72.242.124
206.72.242.162

CISA's KEV addition confirms real-world exploitation activity.

Affected Systems

Any on-premises VeloCloud Orchestrator deployment running a vulnerable version. This includes:

Enterprise SD-WAN deployments using on-prem VCO
MSP/MSSP managed VCO instances
Service provider VCO deployments

Not affected: Arista-hosted VCO, dedicated VCO instances (patched by Arista pre-disclosure).

Mitigation & Patching

Immediate action required:

Upgrade to the fixed version for your branch immediately.
If immediate upgrade is not possible:
- Restrict VCO web interface access to trusted administrative networks only
- Block the three known malicious IPs at network perimeter
- Monitor VCO access logs for connections from unknown IPs
- Check for unexpected outbound connections from VCO host

Patch verification:

bash

Post-exploitation checks (if compromise suspected):

Preserve VCO web access logs, backend application logs, system logs, database logs, and filesystem timestamps
Review administrator activity for unexpected changes
Check VeloCloud Edge device state for unauthorized modifications
Rotate all credentials associated with compromised VCO
Restore or replace affected VCO instances from trusted backups

Detection

Suricata rule for known attacker IPs:

drop ip any any -> $HOME_NET any (msg:"ET MALWARE Arista VCO Exploit Actor IP"; reference:url,thehackernews.com/2026/07/attackers-exploit-arista-velocloud.html; reference:cve,2026-16812; classtype:trojan-activity; sid:202616812; rev:1;)
drop ip $HOME_NET any -> any any (msg:"ET MALWARE Arista VCO Compromise Outbound"; reference:cve,2026-16812; classtype:trojan-activity; sid:202616813; rev:1;)

YARA rule for VCO exploit artifacts:

yara

Sigma rule for suspicious VCO web access:

title: Suspicious VeloCloud Orchestrator Web Access
id: 20260728-arista-vco-suspicious-access
status: experimental
description: Detects potential exploitation of CVE-2026-16812
logsource:
    category: webserver
    product: arista-vco
detection:
    selection_ips:
        c-ip|contains:
            - "8.19.75.217"
            - "206.72.242.124"
            - "206.72.242.162"
    selection_paths:
        cs-uri-stem|contains:
            - "/api/"
            - "/portal/"
            - "/login/"
    condition: selection_ips or selection_paths
fields:
    - c-ip
    - cs-uri-stem
    - cs-method
    - sc-status
level: high
tags:
    - attack.initial_access
    - attack.t1190

Frequently Asked Questions

Q: Is my Arista-hosted VCO affected? A: No. Arista stated that hosted and dedicated VCO instances were patched in advance and are not affected.

Q: How do I know if I'm running on-premises vs hosted VCO? A: On-prem VCO runs on your infrastructure (VM or appliance). Hosted VCO is accessed via a *.velocloud.net or custom domain managed by Arista. Check your deployment architecture or contact Arista support.

Q: What if I can't upgrade immediately? A: Restrict VCO web UI access to trusted admin networks only. Block the three known malicious IPs. Monitor logs for unusual access patterns. These are temporary mitigations—upgrade as soon as operationally feasible.

Q: Does this affect VeloCloud Edge devices directly? A: The vulnerability is in the Orchestrator (management plane). However, Arista warned: "Compromises to the VCO platform may allow attackers access to the VeloCloud Edge devices as well." A compromised VCO can push malicious configs to Edges.

Q: Are there any workarounds that don't require network changes? A: No. The vulnerability is in the web application layer. Network-level restriction of the management interface is the only effective workaround without patching.

Q: Has a public exploit been released? A: As of July 28, no public PoC exploit code has been published. Active exploitation is confirmed but the exploit technique details are not public.

Key Takeaways

Patch now: CVSS 10.0, active exploitation, CISA KEV, 3-day federal deadline. This is a "drop everything and patch" vulnerability.
On-prem only: Hosted/dedicated VCO customers are protected by Arista's pre-disclosure patching.
Edge risk: VCO compromise = potential Edge device compromise. Plan for full SD-WAN infrastructure review if VCO was exposed.
IoCs available: Three attacker IPs published. Block and hunt for them immediately.
Log preservation critical: Arista specifically recommends preserving web access logs, application logs, system logs, database logs, and filesystem timestamps before remediation.

Conclusion

CVE-2026-16812 is a textbook critical infrastructure vulnerability: unauthenticated RCE in a widely deployed SD-WAN management platform, actively exploited, with a KEV listing and immediate patching mandate. If you operate on-premises VeloCloud Orchestrator, upgrade to the fixed version today. If you cannot upgrade immediately, restrict management interface access to trusted networks and monitor aggressively for the published IoCs.

Sources:

Automated Transmission

This entry was synthesized and populated dynamically using native API integrations.

Hello.

Arista VeloCloud Orchestrator CVE-2026-16812: Actively Exploited RCE (CVSS 10.0)