CVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command Injection

Exploited in the wild Critical 10.0 Published 27 Jul 2026 Updated 28 Jul 2026

Remote attackers can execute OS commands on VeloCloud Orchestrator hosts, compromising confidentiality, integrity, and availability.

Exploited in the wild: Since 27 Jul 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-16812?

CVE-2026-16812 is a critical command injection vulnerability in Arista Networks VeloCloud Orchestrator On-Prem, published on 27 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

This functionality was intended to be for internal use only and is not intended to be remotely accessible.

Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out.

This issue was discovered externally and is known to be actively exploited.

Weakness: CWE-78

Which versions are affected by CVE-2026-16812?

It affects 1 product.

Products include Arista Velocloud Orchestrator.

How do I fix CVE-2026-16812?

No fix has been published for CVE-2026-16812 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 30 Jul 2026.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-16812 being exploited?

Yes. Attackers have exploited CVE-2026-16812 in the wild since at least 27 Jul 2026.

Sources

Also known as GHSA-f2cp-q2qv-6563.