Summary
- CVE-2026-16812 is a CVSS 10.0 OS command injection flaw in Arista’s VeloCloud Orchestrator On-Prem, the self-hosted SD-WAN management platform.
- Exploitation requires only access to the web interface — no credentials — and the interface is exposed by default with no configuration option to fully remove that exposure.
- Arista has confirmed active exploitation and published three attacker IP addresses, but has not disclosed who is behind the attacks, when they began, or how many customers are affected.
- CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog; US federal civilian agencies face a compliance deadline, and many private-sector teams treat KEV listings as their own patch prioritisation signal.
- Fixes are available across four release branches; customers on hosted or dedicated Arista-managed orchestrators were already patched before the advisory was published.
What has been disclosed
Arista Networks has issued a security advisory for CVE-2026-16812, a critical vulnerability in VeloCloud Orchestrator On-Prem — the self-hosted platform enterprises use to centrally manage VeloCloud software-defined wide area networks spanning branch offices, datacentres, and cloud environments. The flaw is an OS command injection vulnerability that allows an unauthenticated remote attacker to reach privileged internal functionality that was never intended to be accessible externally. Arista has confirmed the vulnerability carries a CVSS score of 10.0 and that active exploitation has been observed in the wild.
The exposure problem
The severity of this flaw is compounded by a design characteristic: the on-premises orchestrator’s web interface is exposed by default, and Arista states there is no configuration option capable of fully removing that exposure. Exploitation requires only that an attacker can reach the web interface — no valid credentials are needed. That combination of default exposure, zero authentication requirement, and a maximum CVSS score leaves on-premises deployments in a difficult position until patching is complete.
Scope of compromise
Arista’s advisory is direct about the potential impact. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages. Critically, the advisory notes that compromise of the VeloCloud Orchestrator platform may allow attackers access to the VeloCloud Edge devices it manages — meaning lateral movement from the orchestrator into the broader SD-WAN fabric is a realistic downstream risk. The full extent of that exposure will depend on how each organisation’s network is segmented.
What Arista has and has not said
Arista published three IP addresses it has observed conducting attacks and made patched versions available across four release branches. Beyond that, the company has kept detail to a minimum. It has not identified who is behind the exploitation, when attacks began, or how many customers have been affected. The Register sought additional comment from Arista; the company did not respond before publication. The absence of threat-actor attribution and timeline information is notable, though the confirmation of active exploitation was sufficient for CISA to act.
CISA adds the flaw to its KEV catalog
CISA has added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog, which is reserved for vulnerabilities with confirmed real-world abuse. The associated directive formally requires US federal civilian agencies to remediate within the specified timeframe. For private-sector security teams, KEV listings carry no mandatory obligation, but many organisations treat catalog additions as a practical signal for which patches should bypass normal scheduling cycles and be treated as urgent.
Cloud-hosted customers are already covered
Customers using Arista’s hosted or dedicated VeloCloud Orchestrator service were patched before the advisory was published, according to the company. The vulnerability and the remediation obligation sit entirely with operators of on-premises deployments. Fixes are available in VeloCloud Orchestrator versions 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1. Arista has urged customers running earlier releases to upgrade immediately.
A familiar pattern at the network edge
This incident follows a pattern that has become routine across the networking and edge-security sector. Networking gear, VPNs, firewalls, and SD-WAN management platforms have repeatedly been exploited in the wild before customers had an opportunity to patch. The recurring dynamic — where vendors publish advisories confirming active exploitation rather than getting ahead of it — continues to put enterprise security teams in a reactive position on infrastructure that, by its nature, sits at the boundary of the organisation.
Why it matters
VeloCloud Orchestrator On-Prem is the administrative control plane for SD-WAN environments. An attacker who compromises it gains a position from which they can potentially reach every managed Edge device in the network. The zero-authentication exploitation path, combined with default exposure and confirmed active attacks, means any organisation running an unpatched on-premises instance should treat this as an incident-in-progress scenario rather than a routine patch cycle item. The lack of detail from Arista on attribution and scope makes independent threat-hunting against the published IP addresses and internal orchestrator logs a reasonable immediate step while patching is being executed.
What to do now
- Identify all on-premises VeloCloud Orchestrator deployments in your environment and confirm which version each instance is running.
- Upgrade to a fixed release: VeloCloud Orchestrator 5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1, as appropriate for your current branch.
- As an interim measure before patching is complete, restrict the orchestrator web interface to trusted management networks only.
- Block the three attacker IP addresses published in Arista’s security advisory at the network perimeter.
- Review orchestrator and edge device logs for indicators of compromise, using the published IP addresses as an initial hunting pivot.
- Confirm with your Arista account team whether your deployment is on-premises, hosted, or dedicated — hosted and dedicated customers were patched before the advisory was published and are not exposed.
Sources
- The Register: Arista patches actively exploited VeloCloud bug as CISA puts admins on the clock
- CISA KEV: CVE-2026-16812: Arista VeloCloud Orchestrator — Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
- The Hacker News: Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw
