CVE-2026-16812

Arista VeloCloud Orchestrator Vulnerability

Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

CVSS Score

9.8

CRITICAL

Published

27 Jul 2026 00:00

Modified

N/A

Vendor

Arista

Product

VeloCloud Orchestrator

Source

CIRCL

Affected Versions

Fix Vendor Patch / Mitigation Available

Weaknesses (CWE)

CWE-78

References

nvd.nist.gov /vuln/detail/CVE-2026-16812 cve.circl.lu /cve/CVE-2026-16812 cve.mitre.org /cgi-bin/cvename.cgi vuldb.com /

Affected Systems

Arista

VeloCloud Orchestrator

Arista

VeloCloud Orchestrator

Extensible Operating System

External Links

NVD Database CIRCL CISA KEV

KEV Status

Known Exploited Vulnerability