A remote attacker with nothing more than a browser and network access to Arista VeloCloud Orchestrator's web interface can run operating system commands on the box that manages an entire SD-WAN. No username. No password. No exploit chain to assemble first: the function they reach was never supposed to answer requests from outside the console at all.
This is CVE-2026-16812, and it earns the CVSS 10.0 it was scored: network attack vector, no privileges required, no user interaction, full loss of confidentiality, integrity, and availability. Arista published the fix and confirmed active exploitation on July 27, and CISA gave federal civilian agencies until July 30 to patch or disconnect exposed systems, one of the tightest windows CISA has issued this year. This is yours to check if VeloCloud Orchestrator runs on-premises anywhere in your stack, self-hosted or as the console an MSP uses to reach your SD-WAN edges. If you are only on VeloCloud's Hosted or Dedicated service, Arista shipped that fix before the advisory went public and you are not exposed here; read the last section anyway, because the underlying lesson, an admin-only function reachable without a login, is not specific to Arista.
What the bug actually does
CVE-2026-16812 is an OS command injection, CWE-78, in functionality Arista's own advisory describes as "intended to be for internal use only and is not intended to be remotely accessible." It was reachable anyway, through VCO's public web interface, with no authentication step in front of it. Arista's language on the impact is blunt: the flaw "may allow a remote attacker to access privileged internal functionality and impact the VCO host," compromising confidentiality, integrity, and availability of the orchestrator and everything it manages.
VeloCloud Orchestrator is not a passive dashboard; it pushes live configuration to every VeloCloud Edge device in a customer's SD-WAN. Own the orchestrator and an attacker owns the control plane for the whole WAN, not one appliance at a time.
Who's exploiting it, and what's affected
Arista published Security Advisory 0144 on July 27 confirming active, in-the-wild exploitation. CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day. The affected range is precise: on-premises VCO 5.2.x before 5.2.3.14, 6.1.x before 6.1.3.4, 6.4.x before 6.4.2.4, and 7.0.x before 7.0.0.1. Arista has published three attacker IP addresses tied to the campaign so far: 8.19.75.217, 206.72.242.124, and 206.72.242.162. Researchers describe opportunistic scanning behind the activity: attackers sweep for internet-facing VCO web interfaces, send the crafted request, and use the resulting command execution to establish persistence or pivot further, with no reconnaissance on the specific victim required beforehand.
Patch, then confirm you were not already hit
Patch first, because a CVSS 10.0 under active exploitation does not leave room for a next-maintenance-window decision. Then treat the patch as the start of the check, not the end of it, since an orchestrator that sat exposed for even a few days needs its logs read, not just its version number updated.
What to check, in order
- Confirm the running VCO build is 5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1 or later, whichever branch is deployed.
- Confirm the orchestrator's web interface is not reachable from the open internet; if remote access is required, put it behind a VPN or IP allowlist rather than exposing it directly.
- Search VCO web, application, and database logs for requests originating from the three published attacker IPs.
- Review administrator activity logs for configuration changes nobody on the team can account for.
- If VCO was exposed and unpatched at any point since July 27, treat every VeloCloud Edge device it manages as suspect, not only the orchestrator itself.
# Confirm the VCO web interface is not reachable from outside the management network
nmap -Pn -p 443 --script http-title <your-VCO-host> -oN vco-exposure.txt
# Hunt: search VCO logs for the three attacker IPs Arista has published so far
grep -E '8\.19\.75\.217|206\.72\.242\.124|206\.72\.242\.162' \
/var/log/velocloud/{access,application,db}*.logArista's IOC list has already grown once since the advisory published, so pull the current set before searching rather than trusting the three addresses above months from now. If any of them turn up in the logs, or if VCO sat exposed and unpatched during this window, do not stop at rotating the orchestrator's own credentials. Every VeloCloud Edge device it managed inherited that server's trust, and Arista's own post-compromise guidance calls out validating managed-device configuration and rebuilding from a trusted source as part of the cleanup, not just resetting the console password.
Patch VCO first, then account for every edge it was trusted to manage
A CVSS 10.0 with no authentication requirement and confirmed active exploitation does not get scheduled for next sprint. If on-premises VeloCloud Orchestrator is reachable from the internet anywhere in your environment, patch it today, run the log search above, and open an investigation into the edge devices it manages rather than closing the ticket once the orchestrator itself is current.
We audit internet-facing management consoles, exactly the class of infrastructure this bug lives in, as part of our network security assessments. If you want a second set of eyes on what your SD-WAN or remote-management stack exposes to the internet, book a session with our team.
Primary sources: Arista's Security Advisory 0144, CISA's Known Exploited Vulnerabilities catalog entry for CVE-2026-16812, and BleepingComputer's reporting on the exploitation timeline.
Not sure what your edge infrastructure exposes to the internet?
We audit internet-facing management consoles and SD-WAN infrastructure as part of our network security assessments, the admin surfaces that get deployed once and trusted by default afterward. Book a session to talk through your environment.