Critical Zero-Day Under Active Attack

On July 27, 2026, enterprise networking provider Arista published an emergency security advisory warning that attackers are actively exploiting a maximum-severity zero-day vulnerability in on-premises VeloCloud Orchestrator (VCO) deployments. The vulnerability, tracked as CVE-2026-16812, has been assigned a CVSS score of 10.0—the highest possible severity rating on the Common Vulnerability Scoring System scale.

Following Arista's disclosure, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-16812 to its Known Exploited Vulnerabilities (KEV) catalog on July 28, 2026, ordering federal organizations to apply updates or isolate exposed instances immediately.

Understanding the Vulnerability and Its Cause

VeloCloud Orchestrator (VCO) serves as a centralized management plane used by organizations to configure, monitor, and manage Software-Defined Wide Area Network (SD-WAN) deployments and associated edge devices. Because orchestrators maintain direct control over remote enterprise branch nodes, compromising a VCO instance grants threat actors broad administrative oversight over the victim's network core.

CVE-2026-16812 is an unauthenticated Operating System (OS) command injection flaw residing in the VCO web interface. Under default installations, the VCO web interface is exposed to accept incoming network traffic for remote administration. The flaw allows remote, unauthenticated attackers to send crafted web requests that execute arbitrary OS commands with full system privileges on the orchestrator host.

According to Arista, attackers do not require valid tenant credentials, administrative privileges, or user interaction to trigger the vulnerability. Furthermore, because the web interface is exposed by default on on-premises deployments without a built-in configuration option to disable the port, any unpatched instance exposed to the public internet is at risk of remote takeover.

Enterprise Impact and Observed Exploitation

Successful exploitation compromises the confidentiality, integrity, and availability of the orchestrator and all managed SD-WAN data. Threat actors gaining access can manipulate routing configurations, intercept internal enterprise communications, deploy secondary malware, or pivot laterally to connected branch networks.

Although Arista confirmed the flaw was discovered externally and is actively exploited in zero-day attacks, the vendor has not publicly attributed the campaign to a specific threat actor. However, threat intelligence indicators show scanning and exploitation attempts originating from malicious IP infrastructure (including 8.19.75.217, 206.72.242.124, and 206.72.242.162) targeting exposed VCO administration portals.

Affected on-premises software versions include:

Arista confirmed that Hosted and Dedicated VeloCloud Orchestrator cloud environments were patched prior to public disclosure and remain unaffected.

Mitigation and Actionable Protection Steps

System administrators and Security Operations Centers (SOCs) running on-premises VeloCloud Orchestrator deployments should implement the following security measures immediately:

1. Apply Security Updates: Upgrade on-premises VCO instances to fixed releases (5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1) without delay. 2. Restrict Web Interface Access: Place the VCO web interface behind perimeter firewalls, VPNs, or strict IP allowlists to block untrusted internet traffic. 3. Audit System and Access Logs: Examine web server logs and process activity for unexpected OS command executions, anomalous outbound network connections, or unknown API requests. 4. Isolate Suspected Instances: If indicators of compromise are detected, disconnect the VCO server from the broader enterprise WAN to prevent lateral movement.