1. Executive summary
CVE-2026-16812 is a CVSS 10.0 CRITICAL OS command injection vulnerability (CWE-78) in Arista VeloCloud Orchestrator (VCO) On-Prem. The flaw exposes internal-only functionality that was not intended to be remotely accessible, allowing an unauthenticated, network-adjacent attacker to execute arbitrary OS commands on the VCO host, fully compromising its confidentiality, integrity, and availability. NVD records indicate the issue is known to be actively exploited; however, the VERIFIED REFERENCE DATA classifies this CVE as NOT in the CISA KEV catalogue — a discrepancy clients should note when prioritising. Hosted and Dedicated VCO versions were patched prior to public disclosure; On-Prem deployments remain exposed. EMEA financial services running VCO On-Prem face potential full control-plane compromise of their SD-WAN infrastructure.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Active exploitation of a CVSS 10.0 vulnerability on an on-premises orchestrator managing critical network infrastructure, with confirmed "active" exploitation per NVD change history. | If exploitation is confirmed on a client-managed VCO On-Prem instance, the incident likely meets the major-incident threshold and triggers DORA Art. 19 reporting timelines. Clients must classify per Art. 18 first. |
| DORA Art. 24: digital operational resilience testing — general requirements | The vulnerability resides in internal-only functionality that was not intended to be remotely accessible, indicating a gap in exposure validation and boundary testing of the on-prem deployment. | Clients should incorporate internet-exposure validation of VCO On-Prem interfaces into their DORA Art. 24 testing programme. |
| NIS2 Art. 23: incident reporting obligations | For NIS2 in-scope entities, active exploitation of a critical vulnerability in operational network management infrastructure engages early-warning and incident-notification duties. | Confirm exploitation status on managed assets; if compromise is detected, file NIS2 Art. 23 early notification within 24 hours of awareness. |
3. Technical analysis & attack chain
Vulnerability: CVE-2026-16812 — OS command injection (CWE-78) in Arista VeloCloud Orchestrator (VCO) On-Prem.
CVSS: 10.0 CRITICAL (CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P).
Scope of affected products: VCO On-Prem only. Hosted and Dedicated VCO versions were patched by Arista in advance of public disclosure.
Attack chain (confirmed steps from NVD/source data)
- Initial access — remote, unauthenticated: The attacker reaches the VCO On-Prem host over the network. The vulnerable functionality was intended for internal use only and was not designed to be remotely accessible. No authentication is required (PR:N in the CVSS vector). No user interaction is needed (UI:N).
- Command injection: The attacker exploits improper neutralisation of special elements in an OS command (CWE-78), injecting arbitrary OS-level commands through the exposed internal functionality.
- Host compromise: Successful injection grants the attacker access to privileged internal functionality on the VCO host. The CVSS 4.0 vector indicates total technical impact across all security objectives:
VC:H/VI:H/VA:H/SC:H/SI:H/SA:H— meaning both the vulnerable system and subsequent systems are fully compromised in confidentiality, integrity, and availability. - Impact on orchestrator and managed data: The attacker may compromise the confidentiality, integrity, and availability of the orchestrator itself and all data managed by it — potentially including SD-WAN configuration, tunnel credentials, edge device management data, and traffic-routing policies.
Exploitation status: NVD change history records CISA-ADP modifying the SSVC exploitation value to "active" as of 2026-07-27T16:54:19Z. The NVD description states: "This issue was discovered externally and is known to be actively exploited." The VERIFIED REFERENCE DATA supplied for this advisory classifies CVE-2026-16812 as NOT in CISA KEV — we note this discrepancy. The CISA-ADP SSVC record and NVD description both assert active exploitation; the absence from the KEV catalogue may reflect a lag in KEV publication rather than a contradiction. Treat as actively exploited.
Attribution: No threat actor is named in any source. No MITRE ATT&CK actor profile is available. Attribution is unconfirmed.
Confidence caveat: All technical detail above is single-sourced (NVD record and CISA-ADP SSVC metadata). No vendor advisory with patch version numbers, specific affected component names, or exploit technique details was available at time of writing. Verify against Arista's security advisory before enforcement.
4. Mitigation & containment
P1 — within 24 hours
- Identify all VCO On-Prem deployments across the estate. Inventory version numbers and confirm whether each instance is On-Prem (affected) vs. Hosted/Dedicated (patched by vendor).
- Restrict network access to VCO On-Prem management interfaces immediately. Limit exposure to trusted internal management networks only; block all internet-facing access. The vulnerable functionality was "intended for internal use only" — enforce that boundary at the network layer if it was not already.
- Check for indicators of compromise: review VCO host OS logs for unexpected command execution, unusual process spawning, and unauthorised configuration changes. The source provides no specific IOCs; hunt for anomalous shell activity, unexpected child processes of the VCO service, and outbound connections from the VCO host.
- Contact Arista support for the On-Prem patch or mitigation guidance. Hosted and Dedicated versions are already patched; the On-Prem fix should be available or imminent.
P2 — within 72 hours
- Apply the vendor patch to all VCO On-Prem instances as soon as Arista releases it. If a patch is not yet available, request a interim mitigation or hotfix from Arista support.
- Validate network segmentation: ensure VCO On-Prem hosts cannot be reached from untrusted networks, including partner/interconnect segments. The attack vector is network-based with no authentication required — network-level access control is the primary interim control.
- Review VCO-managed edge device configurations for unauthorised modifications that may indicate prior exploitation.
P3 — within 7 days
- Conduct forensic triage on any VCO On-Prem host that was internet-exposed or accessible from untrusted networks. The source references CISA's "Forensics Triage Requirements" — follow that guidance if applicable to your jurisdiction.
- Update asset inventories and exposure management to ensure VCO On-Prem is included in ongoing attack-surface monitoring.
- Document the incident response per DORA Art. 17 ICT-related incident management process, including classification under Art. 18 if exploitation is confirmed.
5. Indicators of compromise
No indicators of compromise available in the source material.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Unexpected OS command execution originating from VCO service processes | VCO host OS process logs, EDR telemetry | Medium — consistent with CWE-78 exploitation mechanism but no specific process names confirmed in source |
| Unauthorised configuration changes to SD-WAN edge devices or tunnel policies | VCO audit logs, edge device configuration diffs | Medium — derived from stated impact on orchestrator-managed data |
| Outbound network connections from VCO host to previously unknown destinations | VCO host firewall logs, network flow data | Low — inferred from full host compromise potential; no C2 indicators in source |
6. Detection
Insufficient indicators to author detection rules.
The source material provides no file hashes, distinctive strings, command-line artefacts, mutex names, scheduled-task names, registry keys, or network signatures associated with exploitation of CVE-2026-16812. Detection should rely on the behavioural indicators in §5: monitor VCO host OS for anomalous command execution and child-process spawning from the VCO service, and alert on unauthorised configuration changes within the orchestrator.
CVE assessment
1 referenced CVE — 1 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-16812 | 10.0 Critical | — | — | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged int… |
7. Sources
- NVD, CVE-2026-16812 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-16812, published 2026-07-26
- CISA-ADP SSVC metadata (via NVD change history for CVE-2026-16812), https://nvd.nist.gov/vuln/detail/CVE-2026-16812, modified 2026-07-27
8. Adverse Trace position
CVE-2026-16812 is a maximum-severity (CVSS 10.0) unauthenticated remote OS command injection in Arista VeloCloud Orchestrator On-Prem, with active exploitation reported by NVD/CISA-ADP though not yet listed in the CISA KEV catalogue per our verified reference data. The attack surface is specific: On-Prem deployments only, with Hosted and Dedicated versions already patched. For EMEA financial services, the risk is not merely server compromise — the VCO is the control plane for the entire SD-WAN estate, and full host compromise could enable traffic interception, tunnel manipulation, and lateral movement to branch sites. Clients should treat this as P1: identify and isolate all VCO On-Prem instances within 24 hours, apply vendor patches as soon as available, and conduct forensic triage on any previously exposed instance. We will monitor for Arista's advisory with specific patch versions and for any emerging IOC sets or actor attribution. Confidence is limited by single-sourcing; all technical claims derive from the NVD record and CISA-ADP metadata only.
Published via PulseTrace — Adverse Trace threat intelligence.