A critical command injection vulnerability (CVE-2026-16812) with a maximum CVSS score of 10.0 has been discovered in on-premises versions of Arista VeloCloud Orchestrator and is being actively exploited. The flaw allows attackers to execute arbitrary code through operating system command injection, posing severe security risks to affected enterprise deployments.
A maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), is a case of operating system command injection that could pave the way for arbitrary code execution. "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
