CVE-2026-16812: Arista VeloCloud Orchestrator CVSS-10 OS Command Injection Exploited in Wild, Added to CISA KEV with 3-Day Patch Deadline

A maximum-severity (CVSS 10.0) unauthenticated OS command injection flaw in on-premises Arista VeloCloud Orchestrator allows remote attackers to access privileged internal functionality and achieve full platform compromise, including lateral reach to all managed SD-WAN edge devices. CISA added CVE-2026-16812 to the KEV catalog on July 27 with a mandatory federal patch deadline of July 30. Arista confirmed external discovery and active in-the-wild exploitation, but has not attributed attacks or disclosed when they began; patched versions are 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1.

CISA added CVE-2026-16812 to the KEV catalog on July 27 with a mandatory federal patch deadline of July 30.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.