{"id":"arista-velocloud-command-injection-jul-2026","category":"patch","status":"live","title":"Arista VeloCloud Orchestrator command injection CVE-2026-16812 exploited; patch coverage remains partial","tldr":"Attackers exploited VeloCloud Orchestrator, which manages business networks. Released fixes cover three branches, but Arista has not confirmed complete coverage. Ask your IT provider to update, restrict management access and check for compromise.","summary":"VeloCloud Orchestrator centrally manages business networks. CVE-2026-16812 allows remote command execution without signing in. Arista disclosed active attacks on 27 July, when CISA also listed the flaw as exploited. On 28 October, Lumen’s Black Lotus Labs linked exploitation before disclosure to Volt Typhoon. As at 3 November, patch coverage remains partial: Arista lists released fixes for the 5.2, 6.1 and 6.4 branches, but omits 7.0 from its resolution section despite identifying 7.0.0.1 as the affected-version cutoff. Its current advisory says Hosted and Dedicated deployments are being patched, whereas BleepingComputer’s July report said they had already been patched. Unsupported releases have not been assessed. Updating does not establish that an already compromised system is clean.","action":"If your business uses VeloCloud, ask its IT provider to confirm a released fix is installed and investigate possible compromise. Restrict the management interface to trusted administrative networks; ask Arista to confirm remediation for 7.0, Hosted or Dedicated deployments.","product":"Arista VeloCloud Orchestrator","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-16812"],"tags":["arista","velocloud","command-injection","zero-day","volt-typhoon"],"affected":["VeloCloud Orchestrator On-Prem and Hosted: 5.2.x before 5.2.3.14","VeloCloud Orchestrator On-Prem and Hosted: 6.1.x before 6.1.3.4","VeloCloud Orchestrator On-Prem and Hosted: 6.4.x before 6.4.2.4","VeloCloud Orchestrator On-Prem and Hosted: 7.0.x before 7.0.0.1"],"fixed":["VCO 5.2.3.14 and later in the 5.2 branch","VCO 6.1.3.4 and later in the 6.1 branch","VCO 6.4.2.4 and later in the 6.4 branch"],"matches":[],"sources":[{"kind":"advisory","title":"Security Advisory 0144","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144","by":"Arista","date":"2026-07-27"},{"kind":"advisory","title":"Arista Networks security advisory (AV26-751)","url":"https://www.cyber.gc.ca/en/alerts-advisories/arista-networks-security-advisory-av26-751","by":"Canadian Centre for Cyber Security","date":"2026-07-28"},{"kind":"news","title":"Arista patches VeloCloud Orchestrator zero-day exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/","by":"BleepingComputer","date":"2026-07-27"},{"kind":"research","title":"Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access","url":"https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework","by":"Lumen Black Lotus Labs","date":"2026-10-28"},{"kind":"news","title":"Volt Typhoon hides zero-day attacks using 'Silent Train' framework","url":"https://www.bleepingcomputer.com/news/security/volt-typhoon-hides-zero-day-attacks-using-silent-train-framework/","by":"BleepingComputer","date":"2026-10-28"}],"started":"2026-07-27","closed":null,"created":"2026-11-03T22:16:11.904Z","updated":"2026-11-03T22:16:11.904Z","cve_notes":[{"cve":"CVE-2026-16812","name":"Command injection in VeloCloud Orchestrator","what":"A command-injection flaw in VeloCloud Orchestrator exposes privileged internal functions through its web interface, allowing an attacker without credentials to compromise the host and managed data.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-10-28","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Lumen’s Black Lotus Labs reported that Volt Typhoon exploited this flaw before disclosure, using its Silent Train network of compromised devices to conceal the attacks.","url":"https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework","by":"Lumen Black Lotus Labs","patch":null},{"at":"2026-08-03","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Arista revised its advisory to add VeloCloud Orchestrator Hosted to the affected platforms.","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144","by":"Arista","patch":"partial"},{"at":"2026-07-27","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added the flaw to its Known Exploited Vulnerabilities catalogue, according to the Canadian Centre for Cyber Security.","url":"https://www.cyber.gc.ca/en/alerts-advisories/arista-networks-security-advisory-av26-751","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-07-27","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Arista disclosed CVE-2026-16812, confirmed active exploitation and published fixes for three VeloCloud Orchestrator branches.","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144","by":"Arista","patch":"partial"}],"url":"https://hard.fyi/live/arista-velocloud-command-injection-jul-2026/","json":"https://hard.fyi/api/live?id=arista-velocloud-command-injection-jul-2026"}