Read the docs
TI-2026-13992 Aliases CVE-2026-16812GHSA-f2cp-q2qv-6563

VeloCloud Orchestrator OS Command Injection

Priority CRITICAL 100Exploited in the wildCWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.

Why it matters now

Exploitation Active In CISA KEV since 2026-07-27CISA due date 2026-07-30
EPSS 0.0176 78th percentileScored 2026-11-07
Fix Fixed VeloCloud Orchestrator On-Prem (Arista Networks): 5.2.3.14, 6.1.3.4, 6.4.2.4 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AristaVeloCloud Orchestrator On-Prem5.2.0 to before 5.2.3.14; 6.1.0 to before 6.1.3.4; 6.4.0 to before 6.4.2.4; 7.0.0 to before 7.0.0.15.2.3.14, 6.1.3.4, 6.4.2.4, 7.0.0.1Patch availableCNA
  • VeloCloud Orchestrator On-Prem VendorArista Affected 5.2.0 to before 5.2.3.14; 6.1.0 to before 6.1.3.4; 6.4.0 to before 6.4.2.4; 7.0.0 to before 7.0.0.1 Fixed in 5.2.3.14, 6.1.3.4, 6.4.2.4, 7.0.0.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*5.2.0 to before 5.2.3.14; 6.1.0 to before 6.1.3.4; 6.4.0 to before 6.4.2.4VulnerableArista
cpe:2.3:a:arista:velocloud_orchestrator:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableArista
  • cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* Versions 5.2.0 to before 5.2.3.14; 6.1.0 to before 6.1.3.4; 6.4.0 to before 6.4.2.4 Vulnerable ·Arista
  • cpe:2.3:a:arista:velocloud_orchestrator:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Arista

Remediation

  • Fix · CNA VeloCloud Orchestrator On-Prem (Arista Networks) Fixed in 5.2.3.14, 6.1.3.4, 6.4.2.4, 7.0.0.1

Timeline

  1. 2026-07-27 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2026-16812
  3. 2026-10-03 Alias added: GHSA-f2cp-q2qv-6563

References

Advisory 1

  • TI-2026-79524 Privilege escalation in Arista VeloCloud Orchestrator on-premises KEVCVSS 4.0CRITICAL 9.4
  • TI-2026-63212 Improper input validation in Arista VeloCloud Orchestrator On-Prem KEVCVSS 4.0CRITICAL 9.5
  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
  • TI-2020-03471 SQL injection in VMware SD-WAN by VeloCloud CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences