Arista Networks has released crucial updates to address a grave OS injection vulnerability in the VeloCloud Orchestrator (VCO). This critical flaw, identified as CVE-2026-16812, has been actively exploited as a zero-day, posing significant risks to affected systems.
Understanding the Vulnerability
The vulnerability carries a maximum CVSS score of 10, underscoring its severity. It allows remote access to privileged functions meant strictly for internal use, potentially compromising the orchestrator’s confidentiality, integrity, and availability, as noted by Arista Networks.
This flaw impacts only the VeloCloud Orchestrator On-Prem (previously known as VeloCloud Orchestrator by Broadcom). The vulnerability has been rectified in VCO versions 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1. The issue was identified externally and is confirmed to be under active exploitation.
Potential Impact and Mitigation
No special configurations or authentication processes are necessary for exploitation, as the VCO is exposed by default. Network access to the VCO web interface is required for an attack, but specific user credentials are not.
To mitigate risks, Arista advises monitoring VCO web access logs for unusual activity and reviewing backend application and system logs for suspicious events, such as requests from malicious IPs or unexpected privileged actions.
Operators should also watch for unauthorized command executions, database exports, and file manipulations. If a breach is suspected, retaining access logs and system timestamps before remediation is recommended where feasible.
Official Recommendations and Warnings
The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog, urging federal agencies to apply patches within three days as required by Binding Operational Directive 26-04.
CISA also alerts about ongoing exploitations of another vulnerability, CVE-2025-68686, related to Fortinet’s FortiOS SSL-VPN, highlighting the critical need for timely updates and vigilance in network security practices.
As cyber threats continue to evolve, addressing known vulnerabilities promptly remains a cornerstone of effective cybersecurity defense strategies. Organizations using affected systems are urged to implement the necessary patches without delay to safeguard their networks.
