TL;DR
- what: Arista disclosed CVE-2026-16812, a CVSS 10.0 OS command injection in on-premises VeloCloud Orchestrator that is already being exploited in the wild.
- impact: Successful exploitation gives a remote attacker privileged internal functionality on the VCO host and can extend to the VeloCloud Edge devices the orchestrator manages.
- fix: Upgrade to VCO 5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1 and block the three IoC addresses 8.19.75.217, 206.72.242.124, and 206.72.242.162 if patching has to wait.
- who: Any organization running self-hosted on-prem VCO; Arista-hosted and dedicated instances were fixed in advance, and FCEB agencies face a July 30, 2026 KEV deadline.
Attackers are actively exploiting CVE-2026-16812, a CVSS 10.0 operating system command injection flaw in on-premises Arista VeloCloud Orchestrator (VCO). Arista confirmed the bug was externally discovered and already under exploitation when it published its advisory on Monday, July 27, 2026. CISA added it to the Known Exploited Vulnerabilities catalog the same week, giving Federal Civilian Executive Branch agencies until July 30, 2026 to patch.
The exposure is not a lateral-movement footnote. VCO is the management plane for a VeloCloud SD-WAN deployment. It holds device credentials, pushes configuration, and controls routing policy across every branch site in the fabric. Arista states plainly that a compromised orchestrator may give attackers access to the VeloCloud Edge devices it manages. One remote command injection on an internet-reachable web interface therefore translates into control of the network edge itself.
What the flaw actually is
Per Arista's advisory, VCO on-prem exposes privileged internal functionality to remote requests. "This functionality was intended to be for internal use only and is not intended to be remotely accessible," the company wrote. That is the classic pattern behind a 10.0 score: an internal administrative code path reachable without authentication, feeding attacker-supplied input into an OS command context.
The CVSS 10.0 rating tells you the rest. Network attack vector, low complexity, no privileges required, no user interaction, scope change, and full impact to confidentiality, integrity, and availability. Arista's own wording confirms compromise of "the orchestrator and data managed by the orchestrator." There is no partial-impact reading of this one.
Affected and fixed versions
Four release branches are affected. Arista has already remediated its hosted and dedicated VCO offerings in advance, so the exposure is specific to customer-operated on-premises deployments.
- VCO 5.2.x - fixed in 5.2.3.14
- VCO 6.1.x - fixed in 6.1.3.4
- VCO 6.4.x - fixed in 6.4.2.4
- VCO 7.0.x - fixed in 7.0.0.1
- Hosted and dedicated VCO - already patched by Arista
⚠️ Block these IPs and check your logs now — Arista published three source addresses it attributes to the active attacks: 8.19.75.217, 206.72.242.124, and 206.72.242.162. Block them at the perimeter and search historical VCO web access logs for hits. A match is an incident, not a scan artifact. Absence of a match is not clearance, since a published IoC set from a single vendor advisory is almost never the full attacker infrastructure.
If you cannot patch today
Arista's interim guidance is straightforward and worth executing regardless of patch timeline, because the mitigations reduce exposure to the next VCO bug as well as this one.
- Restrict access to the VCO web interface to trusted administrative networks only. Internet exposure of a management plane is the root condition being exploited.
- Alert on any connection to VCO from the three published IoC addresses.
- Hunt for unexpected outbound network activity from the VCO host. Command injection payloads typically call back.
- Review recent administrator activity in VCO for changes nobody on your team made: new accounts, role changes, configuration pushes, credential exports.
Incident response considerations
Arista explicitly warns operators to preserve evidence before remediating. That means capturing VCO web access logs, backend application logs, system logs, database logs, and relevant filesystem timestamps prior to any patch or rebuild, "where operationally feasible." Patching first destroys the artifacts you would need to determine whether an attacker was already inside.
If you find evidence of compromise, treat the blast radius as the entire SD-WAN fabric rather than one server. Arista's recommended actions include rotating credentials, reviewing administrator activity, validating the state of managed devices, and restoring or replacing the affected orchestrator instance from trusted sources. Rebuilding VCO from a known-good image while leaving Edge device credentials untouched leaves the attacker's access intact.
Two more KEV additions worth your patch cycle
CISA added a second entry alongside the Arista flaw: CVE-2025-68686, a medium-severity information exposure issue in Fortinet FortiOS SSL-VPN, CVSS 5.3, patched by Fortinet in February 2025. The low score understates its role. Per Fortinet, the flaw lets a remote unauthenticated attacker bypass the patch built for the symbolic-link persistence mechanism seen in earlier post-exploitation cases, via crafted HTTP requests. Exploitation requires prior filesystem-level compromise through another vulnerability, which makes this a persistence tool for attackers who are already in. Federal agencies have until August 10, 2026.
Separately, CVE-2026-16723 in Alibaba's Fastjson library, CVSS 9.0, is under attack and remains unpatched. It permits remote code execution with no user interaction and no elevated privileges. Versions 1.2.68 through 1.2.83 are affected. With no fix available, the options are enabling SafeMode or moving to a non-impacted build. Scan your Java dependency trees, including transitive pulls, since Fastjson frequently arrives as an indirect dependency rather than a declared one.
The pattern to take away — Three of the week's exploited vulnerabilities sit in management and infrastructure layers rather than endpoints: an SD-WAN orchestrator, a VPN appliance persistence bypass, and a serialization library. Attackers keep targeting the systems that administer other systems, because one compromise there yields authenticated access everywhere downstream. Inventory what your management planes can reach, and make sure none of them are reachable from the internet.
Recommended actions
- Patch on-prem VCO to 5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1 based on your branch. FCEB deadline is July 30, 2026; treat it as your deadline too.
- Preserve VCO logs and filesystem timestamps before remediating if compromise is plausible.
- Block 8.19.75.217, 206.72.242.124, and 206.72.242.162 and retro-hunt for them.
- Move the VCO web interface behind an administrative network boundary permanently, not just until you patch.
- If compromised, rotate SD-WAN credentials, validate Edge device state, and rebuild the orchestrator from trusted sources.
- Patch FortiOS for CVE-2025-68686 and audit Java dependencies for Fastjson 1.2.68 through 1.2.83.
Originally published on RedEye Threat Intelligence.
