Organizations operating VeloCloud Orchestrator On-Prem face an urgent security issue after Arista Networks confirmed active exploitation of a critical command injection vulnerability. CVE-2026-16812 carries a CVSS score of 10 and can provide remote access to privileged functionality that should only be available internally.
VeloCloud Orchestrator is a centralized management platform used to administer software-defined wide area networking environments. Control over an orchestrator can give an attacker visibility into network devices, configurations and operational data. It can also create opportunities to disrupt connectivity or weaken the security controls applied across distributed sites.
Exposure without credentials
Arista said the vulnerability affects only VeloCloud Orchestrator On-Prem, formerly offered as VeloCloud Orchestrator by Broadcom. Exploitation does not require tenant or operator credentials, and no unusual product configuration is necessary. An attacker only needs network access to the platform's web interface.
The flaw has been fixed in VCO versions 5.2.3.14, 6.1.3.4, 6.4.2.4 and 7.0.0.1. CISA also added the vulnerability to its Known Exploited Vulnerabilities catalog, reinforcing that defenders should treat the threat as operational rather than theoretical.
Investigation priorities
- Install the appropriate fixed release without waiting for a normal maintenance cycle.
- Check web access logs for unexpected requests and unusual URL-like path components.
- Review backend, system and database logs for unauthorized privileged activity.
- Hunt for unexpected command execution, file creation and database exports.
- Examine access to certificates, credentials, device inventories and configuration data.
- Preserve logs and file timestamps before remediation if compromise is suspected.
Outbound HTTP or HTTPS connections from the orchestrator should also be reviewed, particularly when they cannot be linked to approved administrative workflows. If attackers obtained credentials or cryptographic material, patching the vulnerability alone will not remove their ability to return.
Expert view
In my view, centralized network management systems represent an unusually concentrated risk. They combine broad visibility with powerful administrative capabilities, so a single weakness can affect many locations at once. Organizations should place orchestrator interfaces behind tightly controlled management networks, even when a vendor considers the interface normally exposed. Following an incident, administrators should assume that configurations and secrets may have been viewed, not merely that the appliance itself was touched. Recovery should therefore include credential rotation, configuration validation and monitoring for downstream changes across managed devices.