Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-16812 10.0
Arista · VeloCloud Orchestrator · Added 2026-07-27 · Published 2026-07-27
3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityArista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
VendorArista
ProductVeloCloud Orchestrator
Date added2026-07-27
Due date2026-07-30
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-78
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Descriptions

KEV: Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

NVD: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-08-25 17:46 UTC
Wall time0.4s
Searches1
Component defaultyes
Sources https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144
https://thehackernews.com/2026/07/attackers-exploit-arista-velocloud.html
https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/
https://www.securityweek.com/critical-arista-velocloud-orchestrator-vulnerability-exploited-as-zero-day/
https://www.resecurity.com/blog/article/cve-2026-16812-critical-command-injection-in-arista-velocloud-orchestrator
https://labs.cloudsecurityalliance.org/research/csa-research-note-arista-velocloud-orchestrator-cve-2026-168/
https://github.com/Hatchepsoute/sigma-rules/blob/main/CVE-2026-16812_Arista_VeloCloud_Orchestrator_RCE/README.md

Hunting hypothesis agent

Hunt VCO web logs for unauthenticated POSTs to internal/backend endpoints with shell metacharacters (semicolons, pipes, backticks), then check VCO host process trees for /bin/sh spawned by VCO service and correlate with known attacker IPs.

Research details

ComponentVCO web interface (internal backend diagnostic function exposed without authentication, accepting unsanitized input into OS command execution)
PreconditionsNetwork reachability to the on-premises VCO web management interface over HTTPS; no authentication required (neither tenant nor operator credentials). VCO on-prem is exposed by default with no configuration to prevent exposure. Hosted/Dedicated versions already patched; on-premises versions 5.2.x, 6.1.x, 6.4.x, and 7.0.x are vulnerable. The attack chains two failed security boundaries: an internal privileged backend function reachable via the web interface, and unsanitized user input concatenated into an OS command executed via shell interpreter (Runtime.exec with shell metacharacters). agent
DeliveryNetwork (HTTPS POST to VCO web interface with shell metacharacters in unsanitized parameters, no authentication required)
Public PoCno
Advisoryhttps://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144
Exploit notesNo public weaponized PoC. Resecurity published an educational lab simulation reproducing the vulnerability class (internal diagnostic endpoint exposed via web interface, user input concatenated into shell command, semicolons/pipes for command chaining). The real vulnerable endpoint has not been disclosed by Arista. Sigma detection rules published (Hatchepsoute/sigma-rules). CVSS attack complexity: LOW | CRITICAL severity (CVSS 10.0). Actively exploited as a zero-day. The root cause is two failed security boundaries: an internal-only function exposed through the web interface, and attacker-controlled input reaching OS command execution. Known attacker IPs: 8.19.75.217, 206.72.242.124, 206.72.242.162.
SummaryArista VeloCloud Orchestrator (VCO) On-Prem OS command injection (CWE-78) with CVSS 10.0. An internal backend function intended for local use is exposed through the VCO web interface without authentication; attacker-controlled input is concatenated into an OS command and executed via shell interpreter. This chains two failed security boundaries to achieve unauthenticated RCE on the SD-WAN management plane. Actively exploited as a zero-day; CISA KEV added July 27, 2026. Hosted/Dedicated versions patched in advance. On-premises deployments must upgrade to fixed releases (5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1).

Tia coverage

First reported2026-07-28
First exploit report2026-07-28
Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

active-exploitation-of-cisco-secure-firewall-management-center-vcisa-adds-two-exploited-vulnerabilities-to-kev-arista-velocloud

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub