CVE-2026-16812: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

EPSS trend

Probability

1.00%

Chance of exploitation in the next 30 days

Percentile

62%

Versus all other CVEs

30-day change

-0.57 pp

From 1.57% on 21-09-2026

21-09-202621-10-2026

EPSS score

1.00%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 27-07-2026
Federal due date: 30-07-2026

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144 nvd.nist.gov/vuln/detail/CVE-2026-16812

Public exploits

0 found

No public exploits indexed.

References

2 links

www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144Vendor AdvisoryMitigation
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812Government ResourceUS Government Resource

Related vulnerabilities

CVE-2020-3973aristavelocloud_orchestrator1.13%6y ago08-07-2020 13:46The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted SQL queries and obtain data to which they are not privileged.CVE-2026-31431amazonamazon_linux+365KEV3.44%6mo ago22-04-2026 08:15In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.CVE-2026-17191arista networksvelocloud orchestrator on-prem0.35%2mo ago27-07-2026 16:41An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.CVE-2026-17192arista networksvelocloud orchestrator on-prem0.29%2mo ago27-07-2026 16:36A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.CVE-2026-93952arista networksvelocloud orchestrator (vco) on-prem+1KEV1.06%29d ago22-09-2026 07:37VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

All vulnerabilities invelocloud orchestrator on-prem velocloud_orchestrator

CVE-2026-16812: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References