Arista Networks has identified a severe vulnerability in its VeloCloud Orchestrator (VCO) on-prem platform that allows unauthenticated remote attackers to execute arbitrary OS commands, with confirmed active exploitation in the wild This article explores vulnerability velocloud orchestrator. . The flaw is tracked as CVE-2026-16812, possessing a perfect CVSSv3.1 and CVSSv4.0 score of 10.0, indicating its unauthenticated, network-exploitable nature and complete compromise of confidentiality, integrity, and availability.
Successful exploitation enables attackers to gain access to privileged internal functionalities on VCO hosts, potentially facilitating lateral movement and compromising connected VeloCloud Edge devices.
Affected Versions The vulnerability impacts deployments of the following versions: - On-prem VCO running: - VCO 5.2.x prior to 5.2.3.14 - VCO 6.1.x prior to 6.1.3.4 - VCO 6.4.x prior to 6.4.2.4 - VCO 7.0.x prior to 7.0.0.1 Arista has proactively patched its Hosted and Dedicated VCO offerings, as well as EOS-based products like CloudVision and VeloCloud Gateway/Edge components, before this advisory was issued. Operators should block these indicators and review historical activity logs. Organizations that cannot immediately patch must limit access to the VCO web interface via trusted administrative networks, monitor connections from known malicious IPs, and review recent administrator activity for anomalies.
