VeloCloud Orchestrator – CyberSecurityBoard

Critical CVEs

Critical Arista VeloCloud Orchestrator Command Injection Flaw Exploited in the Wild

A maximum-severity command injection vulnerability in on-premises versions of Arista VeloCloud Orchestrator (VCO) is being actively exploited. Tracked as CVE-2026-16812 with a…

active exploitation Alibaba Alibaba Fastjson Arista

July 28, 2026

Cyber Products

Arista VeloCloud Orchestrator

On-premises SD-WAN orchestration platform affected by CVE-2026-16812 command injection flaw. Patches available for hosted and dedicated versions.

Arista SD-WAN VeloCloud Orchestrator

July 28, 2026

Critical CVEs

CVE-2026-16812 — Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing…

Arista CISA KEV CVE-2026-16812 VeloCloud Orchestrator

July 27, 2026