Security teams running on-premises Arista VeloCloud Orchestrator (VCO) instances need to patch immediately. A maximum-severity command injection vulnerability (CVE-2026-16812, CVSS 10.0) is under active exploitation in the wild, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added it to the Known Exploited Vulnerabilities (KEV) catalog, giving federal agencies until July 30, 2026, to apply fixes.

Vulnerability Details

CVE-2026-16812 is an operating system command injection flaw in the on-premises version of Arista VeloCloud Orchestrator. The vulnerability allows a remote attacker to access privileged internal functionality and achieve arbitrary code execution on the VCO host.

"VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host," Arista stated in its security advisory. "Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible."

The flaw affects the following on-premises VCO versions:

Version Branch	Affected Releases	Fixed Release
5.2.x	Prior to 5.2.3.14	5.2.3.14
6.1.x	Prior to 6.1.3.4	6.1.3.4
6.4.x	Prior to 6.4.2.4	6.4.2.4
7.0.x	Prior to 7.0.0.1	7.0.0.1

Hosted and dedicated VCO versions were patched in advance and are not affected.

Active Exploitation and Indicators of Compromise

Arista confirmed the vulnerability was externally discovered and is known to be actively exploited. The company shared three IP addresses observed conducting attacks:

• 8.19.75.217
• 206.72.242.124
• 206.72.242.162

Organizations should block these IPs at the network perimeter and review VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps for signs of compromise.

Impact Assessment

A compromised VCO platform grants attackers access to the VeloCloud Edge devices managed by that orchestrator. This extends the blast radius significantly:

• Credential rotation for all managed edges
• Review of administrator activity for unexpected changes
• Validation of managed device state
• Potential restoration or replacement of affected orchestrator instances from trusted sources

Arista warns: "Compromises to the VCO platform may allow attackers access to the VeloCloud Edge devices as well."

CISA KEV Catalog Addition

On July 27, 2026, CISA added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog. This binding operational directive requires Federal Civilian Executive Branch (FCEB) agencies to apply patches by July 30, 2026: just two days from the advisory date.

The same CISA alert also added a medium-severity Fortinet FortiOS SSL-VPN vulnerability (CVE-2025-68686, CVSS 5.3) to the KEV catalog, with a federal patch deadline of August 10, 2026.

Mitigation and Patching Guidance

Immediate Patching (Recommended)

Upgrade to the fixed VCO release for your version branch:

Compensating Controls (If Immediate Patching Is Not Possible)

If you cannot upgrade immediately, implement these mitigations:

1. Restrict VCO web interface access to trusted administrative networks only (VPN, jump hosts, allowlisted IPs)
2. Monitor for connections from the three known malicious IPs listed above
3. Watch for unexpected outbound network activity from the VCO host
4. Audit recent administrator activity for unauthorized changes
5. Preserve forensic evidence before remediation: web access logs, backend application logs, system logs, database logs, and file-system timestamps

Detection Rules

Suricata Network Detection

YARA Rule for Post-Exploitation Artifacts

Sigma Rule for Suspicious VCO Log Entries

Frequently Asked Questions

Q: Does this affect VeloCloud hosted or dedicated instances? A: No. Arista confirmed that hosted and dedicated VCO versions were patched in advance and are not affected.

Q: What is the attack vector? A: Network-based, remote, unauthenticated command injection. An attacker with HTTP(S) access to the VCO web interface can exploit this without credentials.

Q: How do I know if I have been compromised? A: Check for connections from the three known malicious IPs in your VCO web access logs. Review system logs for unexpected process execution, outbound connections from the VCO host, and unauthorized administrator accounts or configuration changes.

Q: Is there a workaround if I cannot patch immediately? A: Restrict VCO web interface access to trusted administrative networks only. Monitor for the known malicious IPs and unexpected outbound traffic from the VCO host.

Q: Does patching alone remediate a compromise? A: No. Arista advises that if compromise is suspected, you must also rotate credentials, review managed Edge device state, and consider restoring or replacing the orchestrator from trusted sources.

Q: Where can I get the fixed releases? A: Download from the Arista support portal (support.arista.com) with a valid support contract.

Key Takeaways

1. Patch now: CVE-2026-16812 is a CVSS 10.0 command injection under active exploitation
2. Federal deadline: July 30, 2026: CISA KEV catalog mandates patching for FCEB agencies within 48 hours
3. Blast radius includes managed Edges: A compromised VCO can lead to compromise of all connected VeloCloud Edge devices
4. Three known attacker IPs: Block 8.19.75.217, 206.72.242.124, and 206.72.242.162 immediately
5. Patching is not enough if compromised: Credential rotation, Edge device validation, and potential orchestrator replacement are required post-breach
6. Hosted/dedicated VCO unaffected: Only on-premises deployments are vulnerable

---

Sources: Arista Security Advisory 0144, CISA KEV Alert, The Hacker News