Known Exploited Vulnerabilities July 27, 2026 · CISA KEV Catalog

CVE-2026-16812: Arista Velo Cloud Orchestrator On-Prem OS Command Injection Vulnerability

Summary: CVE-2026-16812 is an OS command injection vulnerability in Arista VeloCloud Orchestrator On-Prem that may let a remote attacker reach privileged internal functionality and impact the VCO host. CISA lists it in the KEV catalog with a remediation due date of 2026-07-30 and notes known ransomware campaign use as unknown.

What you should know: Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages, and CISA's 2026-07-30 due date puts a fixed clock on remediation.

Read the original at CISA KEV Catalog ↗

Topics

Vulnerabilities & Patching

Mentions

AristaCVE-2026-16812

Related

CVE-2026-114625: Arista Velo Cloud Orchestrator SQL Injection Vulnerability Known Exploited Vulnerabilities · Oct 23, 2026

CVE-2026-93952: Arista Velo Cloud Orchestrator Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Sep 22, 2026

CVE-2026-7473: Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability Known Exploited Vulnerabilities · Jun 09, 2026