CVE-2026-16812 is an unauthenticated OS command injection vulnerability in Arista's on-premises VeloCloud Orchestrator (VCO) management platform. It allows remote attackers to access privileged internal functionality and execute arbitrary commands without authentication, compromising confidentiality, integrity, and availability of the orchestrator and managed data. The vulnerability affects VCO 5.2.x before 5.2.3.14, 6.1.x before 6.1.3.4, 6.4.x before 6.4.2.4, and 7.0.x before 7.0.0.1. Hosted and Dedicated VCO deployments, as well as VeloCloud Gateway and Edge products, are not vulnerable. Arista has patched the flaw in the stated versions. The vulnerability is actively exploited, confirmed by CISA inclusion in the Known Exploited Vulnerabilities catalog, with attacks requiring only network access to the VCO web interface and no credentials. Indicators of compromise include unusual web requests, connections from known malicious IPs, unauthorized configuration changes, and suspicious access to sensitive data. Arista recommends patching, restricting web interface access, blocking known malicious IPs, and monitoring logs. Compromise may also lead to access to VeloCloud Edge devices.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the VeloCloud Orchestrator host, leading to full compromise of the orchestrator and the data it manages. This can result in loss of confidentiality, integrity, and availability of the system and potentially connected VeloCloud Edge devices. The flaw is actively exploited in the wild, increasing the risk to affected organizations. Because no credentials are required, the attack surface is broad for any network-accessible VCO web interface. Compromised systems may have unauthorized configuration changes, data exfiltration, and persistent control by attackers.

Arista has released official patches fixing this vulnerability in VCO versions 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1 and later. Organizations should apply these updates immediately. While patches are being deployed, restrict access to the VCO web interface to trusted administrative networks only. Block the known malicious IP addresses (8.19.75.217, 206.72.242.124, 206.72.242.162) and monitor logs for unusual web requests, unauthorized configuration changes, and suspicious activity. If compromise is suspected, preserve logs and filesystem timestamps, rotate credentials, review administrator activity, validate managed devices, and consider restoring or replacing affected instances. End-of-support versions have not been assessed; users should contact Arista support for upgrade options. The U.S. CISA mandates mitigation for federal agencies by July 30, 2026.