CVE-2026-16812: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability Actively Exploited (CISA KEV)

CISA has confirmed that the Arista VeloCloud Orchestrator On-Prem contains a critical OS command injection vulnerability, identified as CVE-2026-16812, which is currently being exploited by attackers. This vulnerability could allow a remote attacker to execute arbitrary commands on affected systems, potentially gaining access to privileged internal functions.

The vulnerability affects the VeloCloud Orchestrator On-Prem platform, a network management and SD-WAN solution used by organizations for managing wide-area networks. According to CISA, attackers can exploit this flaw remotely, without authentication, by sending specially crafted requests that trigger command execution on the host system.

Security firms and government agencies have observed active exploitation, raising concerns about potential widespread impact. The vulnerability is classified as critical due to its ease of exploitation and the level of access it could grant to malicious actors.

Implications for Network Security and Enterprise Operations

This vulnerability poses a serious risk to organizations using Arista VeloCloud Orchestrator On-Prem. Successful exploitation could allow attackers to execute arbitrary OS commands, potentially leading to data breaches, network disruption, or further system compromise. Given the active exploitation, organizations are urged to prioritize immediate mitigation measures to prevent attacks.

Details on the Vulnerability and Its Exploitation

CVE-2026-16812 was identified as a command injection flaw in the On-Prem OS component of Arista’s VeloCloud Orchestrator platform. The vulnerability allows remote attackers to craft malicious requests that execute arbitrary commands on the server hosting the orchestrator. The flaw was publicly disclosed after security researchers identified active exploitation campaigns targeting affected systems.

Arista Networks has acknowledged the issue and issued guidance for affected users, though details on the specific attack vectors remain limited. The vulnerability is linked to insufficient validation of user-supplied input in certain API endpoints, enabling command injection.

“The CVE-2026-16812 vulnerability in Arista VeloCloud On-Prem is actively being exploited, posing a significant threat to affected organizations.”

— CISA

Details of the Exploitation and Patch Timelines

While active exploitation has been confirmed, specific details about the attack techniques, scope, and scale of the campaigns are still emerging. It is also unclear when a formal security patch will be available, though Arista has indicated they are working on remediation.

Expected Patches and Mitigation Strategies

Arista Networks is expected to release a security update addressing CVE-2026-16812 shortly. In the meantime, organizations should implement recommended mitigations such as restricting network access to management interfaces, monitoring for suspicious activity, and applying temporary workarounds if available.

Security agencies and researchers will continue to monitor exploitation campaigns, and further details about the attack methods and scope may be disclosed in upcoming advisories.

Key Questions

What systems are affected by CVE-2026-16812?

The vulnerability affects Arista VeloCloud Orchestrator On-Prem systems. Users should verify their deployment versions and consult Arista’s security advisories.

How can organizations protect themselves now?

Organizations should restrict access to the management interfaces, monitor network traffic for unusual activity, and apply any available patches or workarounds provided by Arista.

Is there a fix available for CVE-2026-16812?

Arista has announced they are developing a patch, but it has not yet been released. Users should stay updated through official channels.

What are the potential consequences of exploitation?

Successful exploitation could allow attackers to execute arbitrary commands, potentially leading to data theft, system control, or network disruption.

How widespread is the exploitation?

Security reports confirm active exploitation campaigns, but the full scope and scale are still being investigated.

Source: kev