1. Executive summary
A maximum-severity OS command injection vulnerability, CVE-2026-16812 (CVSS 10.0), in Arista VeloCloud Orchestrator (VCO) on-premises deployments is being actively exploited as a zero-day. The flaw requires no authentication and no special configuration — VCO is exposed by default — allowing a remote attacker with network access to the VCO web interface to execute arbitrary code and access privileged internal functionality, potentially compromising the confidentiality, integrity, and availability of the orchestrator and all data it manages. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2026-07-28 with a remediation due date of 2026-07-30. EMEA financial services running VCO on-prem face immediate risk of orchestrator compromise, exposing managed device inventory, configurations, certificates, credentials, and key material.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 19 — reporting of major ICT-related incidents to competent authorities | Active zero-day exploitation of a CVSS 10.0 unauthenticated command injection on an orchestrator managing network infrastructure, with confirmed in-the-wild exploitation | If a VCO on-prem instance is compromised (or suspected compromised), the incident likely meets major-incident thresholds given the potential impact on confidentiality, integrity, and availability of managed network services; clients must be prepared to classify and report under their DORA incident process. |
| DORA Art. 24 — digital operational resilience testing — general requirements | VCO is exposed by default with no configuration available to prevent exposure, and the flaw requires no authentication | Clients running VCO on-prem should verify whether this default-exposure posture was identified under vulnerability scanning / testing programmes; the absence of a configuration mitigation means network-level controls are the only interim containment. |
No specific NIS2 or UK NIS article is directly engaged beyond general incident-response obligations, which apply to any security incident and are not distinctive to this item.
3. Technical analysis & attack chain
Vulnerability: CVE-2026-16812 — OS command injection in Arista VeloCloud Orchestrator (VCO) on-premises. CVSS 10.0 (Critical). No authentication required. No special configuration required. VCO is exposed by default; there is no configuration that prevents the exposure.
Affected product: VeloCloud Orchestrator On-Prem (formerly VeloCloud Orchestrator by Broadcom). Cloud-hosted VCO is not affected.
Patched versions: VCO 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1.
Confirmed attack chain
- Initial access — The attacker requires only network access to the VCO web interface. No VCO tenant or operator credentials are needed. The web interface is exposed by default.
- Command injection — The vulnerability is an OS command injection that allows the attacker to access privileged internal functionality intended for internal use only. The specific injection vector and parameter are not detailed in the available source material.
- Arbitrary code execution — Successful exploitation enables arbitrary code execution on the VCO host, compromising the confidentiality, integrity, and availability of the orchestrator and all data managed by it.
- Post-exploitation access — Arista advises defenders to hunt for unexpected actions involving command execution, database exports, file creation, and access to device inventory, configurations, certificates, credentials, and key material — indicating these are the data classes at risk upon compromise.
Attribution: No threat actor is named in any of the available sources. Attribution is unconfirmed. CISA's KEV entry states "Known ransomware campaign use: Unknown."
Confidence caveat: The vulnerability mechanism (OS command injection), CVSS score, exploitation status, and affected versions are corroborated across multiple sources (SecurityWeek, BleepingComputer, The Hacker News, CISA KEV). The specific injection point, exploit payload, and attacker TTPs beyond the initial exploitation are not described in the available source material — the post-exploitation behaviours listed above are Arista's defensive guidance for what to hunt for, not confirmed observed attacker activity.
4. Mitigation & containment
P1 — Within 24 hours
- Identify all VCO on-prem deployments across the estate. Confirm whether each instance is internet-facing or accessible from untrusted network segments. VCO is exposed by default and no configuration change can prevent this exposure — network-level isolation is the only interim control.
- Immediately restrict network access to the VCO web interface. Allow only known administrative source IPs/management jump hosts via firewall ACLs or network segmentation. If the VCO does not need to be reachable from the internet, block all external access now.
- Review VCO web access logs for unexpected activity and unusual URL-like path components. Look for requests from unexpected source IPs, anomalous HTTP methods, or path components that do not correspond to normal operator/tenant workflows.
- Review VCO backend application logs and system logs for follow-up activity: outbound HTTP/S activity, privileged actions not associated with administrative workflows, unexpected command execution, database exports, file creation, and access to device inventory, configurations, certificates, credentials, or key material.
P2 — Within 72 hours
- Apply the vendor patch. Upgrade to the appropriate fixed version: VCO 5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1. Select the target version based on the currently running major/minor branch.
- If compromise is suspected, preserve forensic evidence before remediation: VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps. Do not patch over a compromised host without evidence preservation.
- Rotate credentials and key material managed by the orchestrator if compromise is confirmed or suspected: device certificates, operator/tenant credentials, and any secrets stored in or accessible via VCO.
P3 — Within 7 days
- Conduct a full forensic review of any VCO instance that was exposed to untrusted networks prior to patching, even if no overt compromise indicators were found. The unauthenticated, default-exposed nature of the vulnerability means any reachable instance must be treated as potentially compromised.
- Update vulnerability scanning and asset discovery processes to ensure VCO on-prem instances are included in future scan coverage. The fact that VCO is exposed by default with no configuration mitigation should be flagged as a standing risk in the asset register.
- Review network architecture to confirm that orchestrator and management interfaces are segregated from production and untrusted networks as a standing control, not an ad-hoc response.
5. Indicators of compromise
No atomic indicators of compromise (IPs, domains, hashes, URLs) are present in the available source material. Arista provides behavioural guidance for compromise detection but no specific IOCs.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Unexpected activity in VCO web access logs, including unusual URL-like path components | VCO web access logs | High (vendor guidance) |
| Privileged actions not associated with administrative workflows | VCO backend application logs, system logs | High (vendor guidance) |
| Outbound HTTP/S activity from the VCO host | VCO system logs, network firewall logs | High (vendor guidance) |
| Unexpected command execution on the VCO host | VCO system logs, EDR | High (vendor guidance) |
| Database exports not initiated by authorised administrators | VCO database logs | High (vendor guidance) |
| Unexpected file creation on the VCO host | VCO system logs, file-system timestamps, EDR | High (vendor guidance) |
| Access to device inventory, configurations, certificates, credentials, and key material outside normal workflows | VCO backend application logs, database logs | High (vendor guidance) |
6. Detection
Insufficient indicators to author detection rules. The available sources describe behavioural patterns for log review but do not provide specific strings, command-line arguments, file paths, registry keys, mutex names, or other artefacts suitable for YARA or Sigma rule construction. Defenders should implement log-based detection using the behavioural indicators in §5 as a guide, querying existing SIEM/log platforms for the described anomalous patterns against VCO web access, backend application, system, and database logs.
7. Sources
- SecurityWeek — "Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day" — https://www.securityweek.com/critical-arista-velocloud-orchestrator-vulnerability-exploited-as-zero-day/ — 2026-07-28
- BleepingComputer — "Arista patches VeloCloud Orchestrator zero-day exploited in attacks" — https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/ — 2026-07-28
- The Hacker News — "Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw" — https://thehackernews.com/2026/07/attackers-exploit-arista-velocloud.html — 2026-07-28
- CISA Known Exploited Vulnerabilities — CVE-2026-16812 — https://nvd.nist.gov/vuln/detail/CVE-2026-16812 — 2026-07-28
8. Adverse Trace position
This is a critical-severity (CVSS 10.0), unauthenticated, remotely exploitable command injection in a network orchestrator platform that is exposed by default with no configuration mitigation — the combination of default exposure, no authentication, and active zero-day exploitation makes this an immediate-priority issue for any EMEA financial services client running VCO on-prem. The KEV remediation deadline of 2026-07-30 leaves a narrow window. Clients should treat any VCO instance that was network-accessible from untrusted segments prior to patching as potentially compromised and conduct forensic review accordingly, given the unauthenticated nature of the exploit and the sensitivity of data managed by the orchestrator (device inventory, configurations, certificates, credentials, key material). Attribution is unconfirmed and no ransomware link has been established. We will monitor for emerging IOCs, exploit artefacts, and attribution reporting and update this advisory as corroboration becomes available.
Published via PulseTrace — Adverse Trace threat intelligence.