Attackers Exploit Arista Velo Cloud Orchestrator Command Injection Flaw
Summary: Arista's on-premises VeloCloud Orchestrator carries CVE-2026-16812, an OS command injection flaw rated CVSS 10.0 that the company says can let a remote attacker reach privileged internal functionality and compromise the orchestrator's confidentiality, integrity, and availability. Arista said the bug was externally discovered and is known to be actively exploited, shared three IP addresses it attributed to the attacks, and CISA added the flaw to its KEV catalog with a July 30, 2026 patch deadline for FCEB agencies.
Bottom line: Arista warns that compromise of the orchestrator may extend to the VeloCloud Edge devices it manages, so a single unpatched VCO host can put the network gear underneath it in scope for credential rotation and replacement.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-68686CVE-2026-16723CVE-2026-16812
- Related
- CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista Velo Cloud Cyber Risks ·CVE-2026-16812: Arista Velo Cloud Orchestrator On-Prem OS Command Injection Vulnerability Known Exploited Vulnerabilities · Jul 27, 2026CVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Known Exploited Vulnerabilities · Jul 27, 2026