Arista VeloCloud Orchestrator: Critical Zero-Day Under Active Exploitation, Immediate Patch Required

Introduction

On July 27, 2026, Arista Networks released emergency updates to address a zero-day vulnerability (CVE-2026-16812) affecting on-premises installations of VeloCloud Orchestrator (VCO). The flaw, with a maximum CVSS score of 10.0, allows OS command injection without authentication and has already been exploited in real attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) immediately added the CVE to the Known Exploited Vulnerabilities catalog, mandating federal agencies to mitigate it by July 30, 2026.

Technical Analysis

The vulnerability affects a feature of the VCO web interface originally intended for internal use. This component, which cannot be disabled, remained exposed without any restrictions, allowing a remote unauthenticated attacker to send arbitrary commands to the operating system. The attack requires no privileges or user interaction; mere network reachability of the administration interface is sufficient.

Affected versions:

• 5.2.x prior to 5.2.3.14
• 6.1.x prior to 6.1.3.4
• 6.4.x prior to 6.4.2.4
• 7.0.x prior to 7.0.0.1

VCO instances in hosted/dedicated mode, as well as VeloCloud Gateway and Edge, are not considered vulnerable because they are already updated or architecturally separate from the offending component.

Impact

Successful exploitation gives the attacker full control over the orchestrator, compromising confidentiality, integrity, and availability of managed data. Since VCO manages VeloCloud Edge devices, access can be extended to these appliances, with the ability to alter network configurations or intercept traffic. Arista emphasizes that on systems already compromised, merely applying the patch may not be sufficient: a remediation effort and thorough investigation are necessary to remove any backdoors.

Mitigation

1. Immediate update: install VCO ≥ 5.2.3.14 / 6.1.3.4 / 6.4.2.4 / 7.0.0.1. For unsupported versions, contact Arista technical support.
2. Network restriction: limit access to the web interface to trusted administrative networks only, reducing the attack surface.
3. Block malicious IPs provided by Arista:
   • 8.19.75.217
   • 206.72.242.124
   • 206.72.242.162
4. Log monitoring and analysis: look for web requests with encoded characters, anomalous paths, or references to internal services; unexpected outbound HTTP/HTTPS connections; unauthorized configuration changes or privileged maintenance activities; execution of commands, file creation, suspicious database or archive exports; access to credentials, certificates, or cryptographic keys.
5. In case of suspected compromise: preserve logs and timestamps before cleanup, immediately rotate all credentials, verify the integrity of managed Edge devices, and consider restoring or replacing the VCO instance.

FAQ

Question 1 – If I use VeloCloud Orchestrator in hosted mode, am I at risk?
No. Hosted and dedicated versions are already patched and not vulnerable. The issue exclusively concerns on-premises deployments that are not updated.

Question 2 – What signs indicate that my system has been compromised?
Check logs for web requests with suspicious encodings (e.g., escape sequences), URLs with anomalous paths, outbound connections to unknown IPs, unplanned configuration changes, unscheduled command execution or database exports. The IPs 8.19.75.217, 206.72.242.124, and 206.72.242.162 are clear indicators of malicious activity.

Question 3 – After installing the patch, is the system automatically secure?
Not always. If the orchestrator had already been breached, the attacker may have created persistence mechanisms. It is essential to conduct a forensic investigation, rotate all credentials, and if evidence of intrusion is found, restore the instance from backups prior to the compromise or completely redeploy the environment.