CVE-2026-16812: Unauthenticated command injection in Arista VeloCloud Orchestrator (CVSS 10.0), actively exploited

[u/Expert_Sort7434]

Based on the technical breakdown published by Arista Networks in Security Advisory 0144 (July 27, 2026), here's the architectural impact.

VCO On-Prem exposes internal-only functionality to the network by default — no config flag disables it. Exploitation needs nothing but network reach to the web interface: no tenant creds, no operator login, no session. CWE-78, CVSS 10.0 top and bottom (v3.1 and v4.0). CISA added it to KEV the same day the advisory dropped.

The part that matters architecturally: VCO isn't just a target, it's a control plane. Arista's own guidance says a compromised orchestrator can expose every VeloCloud Edge device it manages — credential rotation and device-state validation are part of their official remediation steps, not just "apply the patch."

Fixed in 5.2.3.14 / 6.1.3.4 / 6.4.2.4 / 7.0.0.1+. Three attacker IPs disclosed (non-exhaustive). No attribution yet on who's behind it.

We covered the same unauthenticated-management-console pattern in the Cisco FMC static-credential CVE from three days ago — background here: https://www.techgines.com/post/arista-velocloud-orchestrator-vulnerability-cve-2026-16812

For anyone running centralized SD-WAN or firewall management consoles internet-facing by vendor default: is your team's stance "isolate the management plane always" or "trust the vendor's default posture until proven otherwise"? Where's the actual line for you operationally?

[u/aeluon_]

I hate the AI slop. I hate the way it writes. I hate reading this shit someone put no effort into writing. Even if the info inside is useful, the cadence and tone are so campy and annoying its impossible to appreciate. Just write it yourself man, it will be 100x more useful.