VulnerabilityBleeping Computer
10.0 — CRITICAL
Arista patches VeloCloud Orchestrator zero-day exploited in attacks
Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Arista has patched a maximum-severity command injection vulnerability in VeloCloud Orchestrator, tracked as CVE-2026-16812, which is being actively exploited in attacks, compromising the confidentiality, integrity, and availability of orchestrator data.
⚙️Technical Details
Affected Systems
VCO 5.2.x releases before 5.2.3.14VCO 6.1.x releases before 6.1.3.4VCO 6.4.x releases before 6.4.2.4VCO 7.0.x releases before 7.0.0.1
Attack Vectors
NETWORK
💥Impact Assessment
Severity: CRITICAL
Who Is at Risk
Organizations running VeloCloud Orchestrator on-premises deployments with affected versions
🛡️Recommended Actions
1Restrict access to the VCO web interface to administrative networks
2Monitor for connections from known malicious IP addresses
3Review recent administrator activity for unusual changes
📦Affected Products
VeloCloud Orchestrator on-premises deployments
🔐NVD Verified DataVERIFIED
CVE-2026-16812 ↗CVSS 10 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HWeaknesses
CWE-78
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.