CVE-2026-16812: Arista VeloCloud Orchestrator — Zero-Day Enables Remote Command Execution (June 2026)

CVE-2026-16812 — Arista VeloCloud Orchestrator

CVE-2026-16812 is a critical unauthenticated OS command injection vulnerability (CVSS 10.0) in Arista's on-premises VeloCloud Orchestrator. The flaw is under active exploitation, enabling remote attackers to execute privileged commands without credentials, leading to potential compromise of orchestrator hosts, managed data, and connected edge devices.

Attack Vector

Attackers exploit a flaw in the VeloCloud Orchestrator's input validation, sending crafted requests to the management interface. No authentication is required; a remote attacker can inject arbitrary OS commands, gaining system-level access. Exploitation can result in full control over the orchestrator and lateral movement to managed edge devices. No indicators of compromise (IOCs) are currently published, so defenders must focus on patching and log review.

Who Is at Risk

All organizations running Arista's on-premises VeloCloud Orchestrator are at immediate risk, regardless of deployment size or industry. The vulnerability impacts any unpatched instance exposed to network access. Arista is the confirmed affected vendor; cloud-hosted versions are not mentioned as impacted.

Patch & Mitigate

• Patch: Apply the official Arista security update for VeloCloud Orchestrator immediately. Refer to Arista advisories for exact fixed versions and release notes.
• Workaround: No effective workaround is documented. Restrict network access to the orchestrator interface as a temporary measure.
• Detect: Review orchestrator logs for unusual or unauthorized command execution, unexpected system-level process launches, and anomalous access patterns to the management interface.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit exposed management interfaces to gain entry.
• TA0005 — Defense Evasion: Attackers may use command injection to bypass authentication and escalate privileges.

Source: https://www.hendryadrian.com/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/