# CVE-2026-16812: Arista VeloCloud Orchestrator OS command injection in on-prem host

Source: https://junglewise.ai/threats/cve-2026-16812-arista-velocloud-orchestrator-os-command-injection-in-on-prem  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-16812 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-07-27

Arista VeloCloud Orchestrator is a management platform used to control and monitor SD-WAN network infrastructure. A critical security flaw allows unauthorized remote attackers to execute commands on the system, potentially leading to a full takeover of the orchestrator. This could result in the theft of sensitive network data, disruption of corporate connectivity, and unauthorized changes to network configurations.

Technologies: [Arista Networks VeloCloud Orchestrator On-Prem](https://junglewise.ai/threats/technologies/velocloud-orchestrator-on-prem). Vendors: [Arista Networks](https://junglewise.ai/threats/vendors/arista-networks).

## Quick answers

**Is CVE-2026-16812 exploited in the wild?** Yes. CVE-2026-16812 is known to be exploited in the wild, first recorded on 27 July 2026. Treat it as urgent.

**How severe is CVE-2026-16812?** Critical severity, with a CVSS score of 10, published 27 July 2026.

**Which products and versions are affected?** Arista Networks VeloCloud Orchestrator On-Prem 5.2.0 < 5.2.3.14, 6.1.0 < 6.1.3.4, 6.4.0 < 6.4.2.4, 7.0.0 < 7.0.0.1, 5.2.x prior to 5.2.3.14, 6.1.x prior to 6.1.3.4, 6.4.x prior to 6.4.2.4, 7.0.x prior to 7.0.0.1.

**Is there a fix for CVE-2026-16812?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16812 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-16812?** Check whether you run Arista Networks VeloCloud Orchestrator On-Prem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in Arista VeloCloud Orchestrator (VCO) On-Prem due to improper neutralization of special elements in internal functionality that was unintentionally exposed to remote access. The vulnerability is network-reachable and requires no authentication or user interaction (AV:N/AC:L/PR:N/UI:N). Successful exploitation allows an attacker to execute arbitrary commands on the VCO host with high privileges, leading to a complete compromise of confidentiality, integrity, and availability. Arista has released patches for affected versions, and hosted/dedicated versions were patched prior to public disclosure. This vulnerability is known to be actively exploited.

## Affected products

- Arista Networks VeloCloud Orchestrator On-Prem 5.2.0 < 5.2.3.14, 6.1.0 < 6.1.3.4, 6.4.0 < 6.4.2.4, 7.0.0 < 7.0.0.1

## Timeline

- 2026-07-27: disclosed
- 2026-07-27: advisory
- 2026-07-27: exploited: Reported as actively exploited at the time of disclosure.

## Related threats

- [Arista VeloCloud Orchestrator SSRF due to missing input validation](https://junglewise.ai/threats/cve-2026-17192-arista-velocloud-orchestrator-ssrf-due-to-missing-input)
- [Arista VeloCloud Orchestrator SQL injection in flow metrics API](https://junglewise.ai/threats/cve-2026-17191-arista-velocloud-orchestrator-sql-injection-in-flow-metrics-api)