This Critical VeloCloud Flaw Is Being Actively Exploited Right Now

Robert Moore · 2026-07-28

A maximum-severity security flaw in on-premises versions of Arista VeloCloud Orchestrator (VCO) is now being actively exploited in the wild. That's not a drill, and it's not a hypothetical threat. It's happening right now. This vulnerability, tracked as CVE-2026-16812, carries a CVSS score of 10.0. That's the highest possible severity rating. It's an operating system command injection flaw, which means attackers can execute arbitrary code on affected systems. Think of it like handing the keys to your network to someone with bad intentions. ### What Makes This So Dangerous? Command injection vulnerabilities are particularly nasty because they allow attackers to run system-level commands directly on the server. In this case, the flaw exists in the VCO's orchestration layer, which is the brain of the VeloCloud SD-WAN solution. If an attacker gains control, they can: - Install malware or backdoors - Steal configuration data and credentials - Disrupt network operations - Move laterally to other systems within your infrastructure This isn't just a theoretical risk. Security researchers have confirmed active exploitation, meaning attackers are already scanning for vulnerable systems and launching attacks. If you're running an on-premises VCO, you need to act fast. ### Who Should Be Worried? Any organization using Arista VeloCloud Orchestrator on-premises is at risk. This includes enterprises that rely on SD-WAN for branch office connectivity, remote workforces, or multi-site operations. The flaw doesn't affect cloud-hosted VCO instances, but if you're running your own on-prem deployment, you're in the crosshairs. ### What Should You Do? First, check if your VCO version is vulnerable. Arista has released patches for this issue, so the immediate step is to apply the update. If you can't patch right away, consider isolating the VCO from the internet or implementing strict network access controls. Here's a quick checklist: - Verify your VCO version against the advisory - Apply the latest security patch from Arista - Monitor logs for unusual command execution or unauthorized access - Review firewall rules to limit exposure - Consider temporary workarounds if patching is delayed ### The Bigger Picture This isn't an isolated incident. Command injection flaws are among the most common and dangerous vulnerabilities in enterprise software. They often arise from insufficient input validation, which is a basic security practice that still gets overlooked. The fact that this one has a CVSS score of 10.0 underscores how critical it is to take it seriously. For IT teams, this is a reminder to stay on top of patch management. Vulnerabilities like CVE-2026-16812 don't give you much time to react. Once they're public and exploit code is available, the window for remediation shrinks dramatically. ### Final Thoughts If you're responsible for your organization's network security, this should be your top priority today. Don't assume you're safe just because you haven't seen any alerts. Active exploitation means the threat is real and present. Patch now, audit your systems, and make sure your incident response plan is ready. Stay safe out there. The bad guys are counting on you to be slow.