Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw

A maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has been actively exploited in the wild. The vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), is a case of operating system command injection that could pave the way for arbitrary code execution.

Arista said in a Monday advisory that the vulnerability has already been addressed in hosted and dedicated versions of VCO in advance. The following versions are affected:

• VCO 5.2.x releases prior to 5.2.3.14
• VCO 6.1.x releases prior to 6.1.3.4
• VCO 6.4.x releases prior to 6.4.2.4
• VCO 7.0.x releases prior to 7.0.0.1

The company acknowledged that the vulnerability was externally discovered and known to be actively exploited, but did not reveal when it was disclosed and how many customers may have been potentially impacted as part of malicious cyber activity weaponizing the bug. As indicators of compromise (IoCs), the company shared a set of three IP addresses that it said were responsible for "conducting the attacks":

• 8.19.75.217
• 206.72.242.124
• 206.72.242.162

"If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible," it added. If immediate updating to a fixed VCO release is not an option, it’s recommended to restrict access to the VCO web interface to trusted administrative networks, monitor the VCO for access from known malicious source IPs, check for unexpected outbound network activity from the VCO host, and review recent administrator activity for unexpected changes. "Compromises to the VCO platform may allow attackers access to the VeloCloud Edge devices as well," Arista said. "This may include credential rotation, review of administrator activity, validation of managed device state, and restoration or replacement of affected orchestrator instances from trusted sources."

The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the flaw to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patch by July 30, 2026. News of active exploitation of CVE-2026-16812 arrives as the agency also added a medium-severity security vulnerability impacting Fortinet FortiOS SSL-VPN (CVE-2025-68686, CVSS score: 5.3) to the KEV catalog, citing evidence of active exploitation. The shortcoming was patched by Fortinet earlier this February. "An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiOS SSL-VPN may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests," Fortinet said in an alert at the time. "An attacker would need first to have compromised the product via another vulnerability, at the file system level." There are currently no details on how the vulnerability is being exploited in the wild, the scale of attacks, and who is behind them. Federal agencies have time till August 10, 2026, to apply the patches. Another security flaw that has come under attack is CVE-2026-16723 (CVSS score: 9.0), a critical issue in Alibaba's Fastjson library that could allow remote code execution without user interaction or elevated privileges. The vulnerability remains unpatched. Developers using versions 1.2.68 through 1.2.83 are urged to enable SafeMode or switch to a non-impacted build as soon as possible.