Arista rushes fix for VeloCloud flaw already being used in attacks

Key points

• Arista patched CVE-2026-16812, a maximum-severity 10.0 command injection flaw in on-premises VeloCloud Orchestrator, on Monday.
• The bug lets anyone who can reach the web interface run commands on the server without a username or password.
• Attackers are already exploiting it in the wild, and CISA has ordered U.S. federal agencies to patch by July 30, 2026.
• Fixed versions are VCO 5.2.3.14, 6.1.3.4, 6.4.2.4 and 7.0.0.1; hosted and dedicated deployments were patched before disclosure.
• Arista published three attacker IP addresses and warns that a breached orchestrator can expose every VeloCloud Edge device it manages.

Arista has shipped an emergency patch for a critical flaw in VeloCloud Orchestrator, the console that companies use to run their VeloCloud SD-WAN networks (software that steers office internet traffic between branches). The catch: criminals were already exploiting it before the fix landed.

The bug is tracked as CVE-2026-16812 and carries a severity score of 10.0 out of 10. It is an unauthenticated OS command injection, meaning an attacker who can simply reach the orchestrator's web page can trick it into running commands on the underlying server. No login required.

First reported by BleepingComputer, the flaw affects on-premises installs of VeloCloud Orchestrator, often shortened to VCO. Arista's own hosted and dedicated versions were quietly patched before the advisory went out.

What is VeloCloud Orchestrator and why does this matter?

VCO is the central brain for a company's software-defined wide area network. It configures, monitors and pushes policy to all the edge boxes sitting in branch offices. Break the brain, and you can reach every limb.

Arista's advisory is blunt about the blast radius. A successful attack can hit "the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator." That data includes device inventories, credentials, certificates and cryptographic keys. Arista also warns the attackers can pivot from the orchestrator to the VeloCloud Edge devices themselves.

Make it worse: VCO is exposed by default, and there is no setting to hide the vulnerable functionality. If your orchestrator is reachable from the internet, assume someone has already knocked.

Which versions are affected?

End-of-support versions were not assessed. Arista tells customers on those older trains to contact its technical assistance team about upgrades. In plain English: if you are running unsupported VCO, you do not know if you are safe, and you probably are not.

The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until July 30, 2026 to patch or pull the software offline, under Binding Operational Directive 22-01.

How would defenders spot an attack?

Arista published three IP addresses seen exploiting the bug: 8.19.75.217, 206.72.242.124 and 206.72.242.162. Block them, then check logs for any past connections. The company is careful to say this list is not definitive, so absence of these IPs is not proof of safety.

Administrators should also look for odd web requests with encoded characters, references to internal services, spikes in request volume, unexpected outbound HTTPS traffic from the VCO host, unauthorised config changes, or database exports and archive files appearing where they should not.

One uncomfortable point on the identity side. This is a pre-auth flaw, so multi-factor authentication on the admin console would not have stopped it. An attacker never touches the login page. That is why network-layer restriction matters here more than usual: keeping VCO off the public internet and limiting access to a management network is the meaningful control.

What if a VCO instance was already breached?

Patching alone is not enough for a system that was already hit. Arista's guidance: preserve logs and filesystem timestamps first, then rotate every credential the orchestrator held, review administrator activity, validate every managed edge device, and consider rebuilding the VCO instance from scratch. Certificates and keys stored on the box should be treated as burned.