CVE-2026-16812
On-Prem OS Command Injection in Arista VeloCloud Orchestrator. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 27 July 2026.
- Product
- Arista VeloCloud Orchestrator
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- No known use in ransomware campaigns
- Vendor advisories
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
More from Arista this year.
- CVE-2026-114625 SQL Injection, added
- CVE-2026-93952 Improper Input Validation, added
- CVE-2026-7473 Incomplete Comparison with Missing Factors, added
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.