VeloCloud Orchestrator – CyberSecurityBoard

Critical CVEs

Critical Arista VeloCloud Orchestrator Command Injection Flaw Exploited in the Wild

A maximum-severity command injection vulnerability in on-premises versions of Arista VeloCloud Orchestrator (VCO) is being actively exploited. Tracked as CVE-2026-16812 with a…

active exploitation Alibaba Alibaba Fastjson Arista

July 28, 2026

Cyber Products

Arista VeloCloud Orchestrator

On-premises SD-WAN orchestration platform affected by CVE-2026-16812 command injection flaw. Patches available for hosted and dedicated versions.

Arista SD-WAN VeloCloud Orchestrator

July 28, 2026

Critical CVEs

CVE-2026-16812: Arista VeloCloud Orchestrator Command Injection

A maximum-severity OS command injection vulnerability in on-premises Arista VeloCloud Orchestrator (VCO) with CVSS 10.0, allowing remote attackers to execute arbitrary code…

active exploitation Arista CISA KEV command injection

July 27, 2026