Arista VeloCloud Orchestrator OS Command Injection

CVSS 10.0 critical. Remote attackers can inject OS commands into Arista VeloCloud Orchestrator On-Prem, compromising the SD-WAN management plane.

cat cve-2026-16812.json

Vendor: Arista
Product: VeloCloud Orchestrator On-Prem
CVSS: 10.0
EPSS (exploit probability): 1.8%
Status: kev
CISA patch-by (BOD 22-01): July 30, 2026
Published: July 27, 2026
Source: https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144

Is CVE-2026-16812 being exploited?

Yes. CISA added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog on July 27, 2026. CISA only lists a CVE when it has reliable evidence of exploitation in the wild.

FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.8% (scored October 29, 2026).

CISA KEV[ LISTED ]
ENISA EUVD (exploited)[ — ]
CIRCL KEV[ — ]

Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison

CVE-2026-16812 timeline

2026-07-27Added to CISA KEVsame day as NVD
2026-07-27Published to NVD
2026-07-28First 0dayNews coverage+1d

Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON

What to do

US federal civilian agencies must remediate by July 30, 2026 (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.

OS command injection in Arista VeloCloud Orchestrator On-Prem. A remote attacker can access privileged internal functionality and fully compromise the VCO host — impacting confidentiality, integrity, and availability of the orchestrator and all data it manages.

CISA added CVE-2026-16812 to the Known Exploited Vulnerabilities catalog on July 27, 2026. Active exploitation confirmed. Federal agencies are under BOD 26-04 remediation deadlines.

Patch: consult Arista SA-0144 for fixed versions. NVD entry.

CVE / Vulnerability	Severity	CVSS	EPSS	Added to KEV
CVE-2026-93952 Arista VeloCloud Orchestrator Unauthenticated RCEwrite-up	[ CRITICAL ]	10.0	1.4%	Sep 22
CVE-2026-7473 Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability	[ MEDIUM ]	5.8	1.1%	Jun 9

Related coverage

~/articles/2026-07-27-arista-velocloud-cve-2026-16812-kev

arista

Arista VeloCloud CVE-2026-16812 Hits KEV, Patch Now

Arista VeloCloud Orchestrator has a CVSS 10.0 OS command injection flaw under active exploitation. CISA added it to KEV July 27. Patch on-prem deployments now.

Jul 28read →