CVE-2026-16812: Arista VeloCloud Privilege Escalation Flaw

CVE-2026-16812 Overview

CVE-2026-16812 is a maximum-severity vulnerability affecting Arista VeloCloud Orchestrator (VCO) on-premises deployments. The flaw exposes privileged internal functionality to remote attackers over the network without authentication. Successful exploitation compromises the confidentiality, integrity, and availability of the orchestrator and all data it manages. The affected functionality was designed for internal use only and should never have been remotely reachable. Arista has confirmed the vulnerability is actively exploited in the wild, and CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog. Hosted and Dedicated VCO instances have been patched by Arista in advance of public disclosure, but on-premises operators must apply fixes directly.

Critical Impact
Unauthenticated remote attackers can access privileged VCO internal functions, fully compromising the SD-WAN orchestrator and any managed data. Active exploitation has been confirmed.

Affected Products

Arista VeloCloud Orchestrator (VCO) on-premises deployments
Arista VeloCloud Orchestrator 7.0.0
Earlier on-prem VCO releases prior to the vendor-supplied fix

Discovery Timeline

2026-07-27 - CVE-2026-16812 published to the National Vulnerability Database
2026-07-28 - Last updated in NVD database
Prior to publication - Arista patched Hosted and Dedicated VCO environments before public disclosure
Active exploitation confirmed - Vulnerability added to the CISA Known Exploited Vulnerabilities catalog

Technical Details for CVE-2026-16812

Vulnerability Analysis

The issue resides in the VeloCloud Orchestrator, the centralized management plane for VeloCloud SD-WAN deployments. VCO exposes internal functionality that was intended to be reachable only from trusted internal components. Due to inadequate access restrictions, the same functionality is reachable by remote unauthenticated attackers over the network. The CWE classification of [CWE-78] indicates the vulnerable code path leads to OS command injection, allowing attackers to execute operating system commands on the VCO host. Because VCO orchestrates SD-WAN edges across an enterprise, compromise of the orchestrator cascades to configuration data, credentials, tunnel policies, and connected sites.

Root Cause

The root cause is missing enforcement of access boundaries around internal-only functionality combined with improper neutralization of special elements used in an OS command [CWE-78]. Endpoints that were assumed to be private were exposed on the network interface without authentication or authorization checks, and inputs passed to those endpoints reach a shell or command interpreter without adequate sanitization.

Attack Vector

Exploitation requires only network access to the VCO management interface. The attacker sends crafted requests to the exposed internal functionality, which the orchestrator processes with elevated privilege on the host. No user interaction is required, and no prior credentials are needed. Successful requests result in command execution and full control of the orchestrator host. See the Arista Security Advisory #0144 for technical details.

Detection Methods for CVE-2026-16812

Indicators of Compromise

Unexpected outbound connections from the VCO host to unknown IP addresses following inbound HTTPS requests
New shell processes (/bin/sh, bash, nc, curl, wget) spawned as child processes of the VCO web or API service
Unusual entries in VCO application, web server, or system authentication logs referencing internal-only endpoints
Creation or modification of files in web-accessible directories on the VCO host

Detection Strategies

Monitor VCO application and web logs for requests targeting internal or administrative API paths originating from external IP ranges
Alert on process-lineage anomalies where the orchestrator service parents shell or scripting interpreters
Correlate authentication logs with configuration changes to identify actions performed without a valid administrative session
Compare configuration snapshots and file integrity baselines on the VCO host against known-good state

Monitoring Recommendations

Ingest VCO, host operating system, and network firewall logs into a centralized analytics platform for correlation
Track egress traffic from the VCO host and flag any connections to non-approved destinations
Watch for creation of new local users, SSH keys, or cron jobs on the orchestrator host

How to Mitigate CVE-2026-16812

Immediate Actions Required

Apply the fixed VCO release referenced in the Arista Security Advisory #0144 to all on-premises Orchestrator instances
Restrict network access to the VCO management interface to trusted administrative networks only, using firewall or ACL controls
Rotate all administrative credentials, API tokens, and shared secrets managed by VCO after patching
Review orchestrator, host, and connected edge device logs for indicators of compromise dating back to before the patch window

Patch Information

Arista has released fixed on-premises builds referenced in Arista Security Advisory #0144. Hosted and Dedicated VCO tenants were patched by Arista prior to public disclosure and require no customer action. On-premises operators must upgrade to the vendor-specified fixed version. Additional exploitation context is available in the CISA Known Exploited Vulnerabilities Catalog.

Workarounds

Place the VCO management interface behind a VPN or jump host until patches are applied
Deploy network-layer ACLs that block all traffic to VCO administrative endpoints from untrusted sources
Enable enhanced logging and forward VCO logs off-host so a compromise cannot destroy local evidence
Isolate the VCO host on a dedicated management VLAN with strict egress filtering

bash

# Example: restrict inbound access to VCO management interface to a trusted admin subnet
iptables -A INPUT -p tcp -s 10.0.10.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Example: block egress from VCO host except to approved SD-WAN edge networks
iptables -A OUTPUT -d 10.10.0.0/16 -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -j DROP