DMZ//THREAT INTEL
FEED ACTIVELAST SYNC: 05:09:16ZSOURCES: 14CRITICAL: 39
⚠ ACTIVE ALERTS
@MsftSecIntel CRITICAL — Microsoft Defender Experts tracked increased ACR Stealer activity from late April through… /// @TalosSecurity CRITICAL — Qilin RaaS remains the most active ransomware operation globally in 2026 with 500+… /// @CrowdStrike CRITICAL — VECT ransomware + TeamPCP supply chain credential theft + BreachForums mass affiliate… /// @MandiantThreats CRITICAL — Tracking Qilin affiliate recruitment activity on Russian-language cybercrime forums… /// @FalconFeedsio CRITICAL — Dark web monitoring alert: FIFA World Cup 2026 credential ecosystem fully operational on…
39Critical Threats
18Active CVEs
8IOCs Tracked
11New Advisories
INTEL FEED/CVE TRACKER/CVE-2026-16812
TLP:WHITEVULNERABILITY BRIEF // CVE-2026-16812PUBLISHED: 2026-07-28
■ CRITICALCVE-2026-16812★ CISA KEV LISTED

Arista VeloCloud Orchestrator Unauthenticated OS Command Injection

VENDOR: Arista Networks//PRODUCT: VeloCloud Orchestrator (VCO) On-Prem
10
CRITICAL
CVSS 3.1
✓
PATCH STATUS
PATCH AVAILABLE
◐
EXPLOIT STATUS
LIMITED EXPLOITATION

VULNERABILITY OVERVIEW

An unauthenticated OS command injection vulnerability (CWE-78) in the VeloCloud Orchestrator On-Prem web interface allows remote attackers to access privileged internal functionality never intended for external exposure, enabling full compromise of the orchestrator and all managed SD-WAN edge devices. Arista confirmed the vulnerability was externally discovered and is known to be actively exploited in the wild. Added to CISA KEV on July 27, 2026; Hosted and Dedicated VCO deployments were pre-patched before public disclosure.

CVSS BREAKDOWN

↗
Attack Vector
NETWORK
△
Attack Complexity
LOW
⚷
Privs Required
NONE
◈
User Interaction
NONE
⊕
Scope / Impact
CHANGED
C:H · I:H · A:H
AFFECTED VERSIONSVCO On-Prem 5.2.x prior to 5.2.3.14, 6.1.x prior to 6.1.3.4, 6.4.x prior to 6.4.2.4, 7.0.x prior to 7.0.0.1

CITATIONS

  • → https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144
  • → https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/
  • → https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
  • → https://www.securityweek.com/critical-arista-velocloud-orchestrator-vulnerability-exploited-as-zero-day/
SHARE BRIEF:✕ Post on Xin Share on LinkedIn