Arista Patches Critical VeloCloud Orchestrator Zero-Day Already Exploited in Attacks

Arista has released a fix for a critical vulnerability in on-premises VeloCloud Orchestrator (VCO) deployments running on customers' own servers. The flaw received the highest possible severity score — 10.0 out of 10 — and, according to the vendor, is already being actively exploited in real-world attacks.

VeloCloud Orchestrator is a centralized platform for configuring, monitoring, and managing SD-WAN deployments and the associated edge devices. The vulnerability, tracked as CVE-2026-16812, belongs to the OS command injection class and requires no authentication: an attacker only needs network access to the VCO web interface, with no operator or tenant credentials required.

Why this is especially dangerous

According to Arista, the VCO web interface is externally accessible by default, and there is no built-in option to close off that access. The vulnerability exposes remote attackers to privileged functionality intended solely for internal use. Successful exploitation compromises the confidentiality, integrity, and availability of both the orchestrator itself and all the data it manages. What's more, a compromise of the VCO could give attackers access to VeloCloud Edge devices as well.

Arista reports that the flaw was discovered by third-party researchers, but does not disclose when the attacks began, who is behind them, or exactly how the vulnerability is being exploited.

What's affected and what to do

The affected versions are on-premises VCO 5.2.x prior to 5.2.3.14, 6.1.x prior to 6.1.3.4, 6.4.x prior to 6.4.2.4, and 7.0.x prior to 7.0.0.1. The fixes are included in builds 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1 and later. Hosted and Dedicated cloud deployments were patched before the advisory was published, and the VeloCloud Gateway and Edge products are not affected by the issue. End-of-life versions were not evaluated — their owners are advised to contact Arista technical support.

The U.S. agency CISA has added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to remediate it by July 30, 2026.

While the patches are being deployed, administrators are advised to restrict access to the VCO web interface to administrative networks and to review their logs. Arista has listed three IP addresses observed in exploitation: 8.19.75.217, 206.72.242.124, and 206.72.242.162 — blocking them is recommended, though the list is not exhaustive. An important warning: if a system has already been compromised, installing the update is not enough. Affected organizations should rotate credentials, review administrator activity, validate managed devices, and consider restoring or replacing the affected instances.

Source: Bleeping Computer