CVE-2026-16812

VeloCloud Orchestrator OS Command Injection

State: Published
Severity: 10.0 Critical
Published: Jul 27, 2026
Updated: Jul 28, 2026
Reserved: Jul 23, 2026

Description

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

This functionality was intended to be for internal use only and is not intended to be remotely accessible.

Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out.

This issue was discovered externally and is known to be actively exploited.

Scores

CVSS	Score	Vector	Source
4.0	10.0 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P	Arista
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	Arista

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
VeloCloud Orchestrator On-PremArista Networks	5.2.0 to before 5.2.3.14Affected 6.1.0 to before 6.1.3.4Affected 6.4.0 to before 6.4.2.4Affected 7.0.0 to before 7.0.0.1Affected

References

Security Advisory 0144vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.