Hackers Exploit Critical Arista VeloCloud Flaw to Execute OS Commands

Arista Networks has issued a warning about attackers actively exploiting CVE-2026-16812, a critical unauthenticated OS command injection vulnerability in on-premises VeloCloud Orchestrator (VCO) deployments.

This flaw carries a CVSS v3.1 and v4.0 severity score of 10.0, allowing a remote attacker with network access to the VCO web interface to access privileged internal functions and potentially compromise the orchestrator host.

Critical Arista VeloCloud Flaw

On July 27, 2026, Arista published Security Advisory 0144, urging organisations to patch any exposed appliances.

The issue is tracked internally as BUG 1901675. It is categorized under CWE-78, which refers to the improper neutralization of special elements in OS commands.

According to the advisory, VCO is exposed by default, and no configuration can eliminate this vulnerability. The exploitation requires no tenant or operator credentials, user interaction, or an attack chain; only access to the web interface is required.

A successful attack could jeopardize the confidentiality, integrity, and availability of the orchestration platform and the data it manages.

Arista cautioned that a compromised VCO could provide attackers a pathway to VeloCloud Edge devices. The hosted and dedicated VCO offerings were patched before the advisory was released. However, the VeloCloud Gateway and VeloCloud Edge products are not directly affected.

The impacted installations include VCO versions earlier than 5.2.3.14, 6.1.x earlier than 6.1.3.4, 6.4.x earlier than 6.4.2.4, and 7.0.x earlier than 7.0.0.1.

Arista has released fixes for the supported 5.2, 6.1, and 6.4 branches, but there is currently no remediated build for version 7.0.

Administrators running an unsupported version are encouraged to contact Arista TAC to discuss upgrade options.

Software not listed in the affected-release table is not vulnerable, although end-of-support versions have not been assessed. Arista switches, CloudVision products, and former Broadcom product lines are not affected.

Arista noted that there are no definitive indicators of compromise, making centralized log review essential. Defenders should investigate any anomalous VCO web requests and monitor for high request volumes.

The company identified three IP addresses observed in attacks: 8.19.75.217, 206.72.242.124, and 206.72.242.162. Organizations should block these addresses and scrutinize web access, application, system, database, and file system logs.

Suspicious findings may include unauthorized configuration changes, privileged maintenance activities, command executions, database exports, unexpected outbound HTTP or HTTPS connections, and unauthorized access to device inventories, credentials, certificates, keys, or configuration data. Correlating these events can help determine if exploitation has occurred on the host.

Until patches are deployed, Arista recommends restricting access to the VCO web interface to trusted administrative networks, monitoring for the identified malicious sources, watching outbound traffic, and reviewing actions taken within the system.

These measures can help reduce exposure since VCO is exposed by default and cannot be fixed through configuration alone. Organizations that suspect a compromise should preserve logs and filesystem timestamps before remediation, if possible.

Post-remediation actions should include credential rotation, validation of system integrity, review of administrative activities, and trusted restoration of any compromised instances.

Given the active exploitation of this vulnerability, teams should prioritize patching and incident response for internet-accessible on-premises VCO systems.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.