Arista VeloCloud Orchestrator (VCO) On-Prem is affected by CVE-2026-16812, which lets an unauthenticated remote attacker reach privileged functionality intended only for internal use. Arista's CNA record says exploitation can compromise the confidentiality, integrity, and availability of the orchestrator and its managed data, confirms known active exploitation, and rates the issue CVSS v3.1 10.0 CRITICAL.
Immediate Actions to Take
- ✓Update 5.2 deployments to 5.2.3.14 or later and 6.1 deployments to 6.1.3.4 or later
- ✓Update 6.4 deployments to 6.4.2.4 or later and 7.0 deployments to 7.0.0.1 or later
- ✓Review VCO logs and administrative configuration for unauthorized changes and begin incident response if compromise is suspected
Vulnerability Overview and Scope of Impact
Affected ranges are VCO On-Prem 5.2.0 before 5.2.3.14, 6.1.0 before 6.1.3.4, 6.4.0 before 6.4.2.4, and 7.0.0 before 7.0.0.1. Hosted and Dedicated VCO editions were patched before disclosure. The confirmed issue is remote access to privileged internal functionality; the public CVE record does not specify an OS-command-injection mechanism.
Specific Impacts and Attack Scenarios
No authentication or victim interaction is required. Because VCO is central to SD-WAN operations, compromise can expose management data, alter configuration, or interrupt service. The public primary record does not provide a durable malicious-IP blocklist, so defenders should combine patching with log review and configuration-integrity checks.
Remediation Steps and Verification Methods
Identify the deployed VCO branch and install at least the fixed build listed above. Confirm whether the service is Hosted, Dedicated, or On-Prem. Until the update is complete, restrict management-plane reachability to necessary administrators, while treating that restriction only as temporary risk reduction. Obtain packages and deployment instructions through Arista support and use the CVE and NVD records for public verification.
📦