NewsCompaniesFlawsGuides
Get the app
CriticalPartly fixedBeing used in attacksUpdated

Arista VeloCloud Orchestrator command injection CVE-2026-16812 exploited; patch coverage remains partial

Attackers exploited VeloCloud Orchestrator, which manages business networks. Released fixes cover three branches, but Arista has not confirmed complete coverage. Ask your IT provider to update, restrict management access and check for compromise.

What to do

If your business uses VeloCloud, ask its IT provider to confirm a released fix is installed and investigate possible compromise. Restrict the management interface to trusted administrative networks; ask Arista to confirm remediation for 7.0, Hosted or Dedicated deployments.

What’s happening

VeloCloud Orchestrator centrally manages business networks. CVE-2026-16812 allows remote command execution without signing in. Arista disclosed active attacks on 27 July, when CISA also listed the flaw as exploited. On 28 October, Lumen’s Black Lotus Labs linked exploitation before disclosure to Volt Typhoon. As at 3 November, patch coverage remains partial: Arista lists released fixes for the 5.2, 6.1 and 6.4 branches, but omits 7.0 from its resolution section despite identifying 7.0.0.1 as the affected-version cutoff. Its current advisory says Hosted and Dedicated deployments are being patched, whereas BleepingComputer’s July report said they had already been patched. Unsupported releases have not been assessed. Updating does not establish that an already compromised system is clean.

What
Flaw
Affects
Arista VeloCloud Orchestrator
Affected
VeloCloud Orchestrator On-Prem and Hosted: 5.2.x before 5.2.3.14
VeloCloud Orchestrator On-Prem and Hosted: 6.1.x before 6.1.3.4
VeloCloud Orchestrator On-Prem and Hosted: 6.4.x before 6.4.2.4
VeloCloud Orchestrator On-Prem and Hosted: 7.0.x before 7.0.0.1
Fixed in
VCO 5.2.3.14 and later in the 5.2 branch
VCO 6.1.3.4 and later in the 6.1 branch
VCO 6.4.2.4 and later in the 6.4 branch
CVE
CVE-2026-16812
Since
27 July 2026

Timeline

  1. Update

    Lumen’s Black Lotus Labs reported that Volt Typhoon exploited this flaw before disclosure, using its Silent Train network of compromised devices to conceal the attacks.

  2. Vendor revisedPartly fixed

    Arista revised its advisory to add VeloCloud Orchestrator Hosted to the affected platforms.

  3. CISA added

    CISA added the flaw to its Known Exploited Vulnerabilities catalogue, according to the Canadian Centre for Cyber Security.

  4. Made publicPartly fixed

    Arista disclosed CVE-2026-16812, confirmed active exploitation and published fixes for three VeloCloud Orchestrator branches.

Sources

  1. Security Advisory 0144Arista · 27 July 2026
  2. Arista Networks security advisory (AV26-751)Canadian Centre for Cyber Security · 28 July 2026
  3. Arista patches VeloCloud Orchestrator zero-day exploited in attacksBleepingComputer · 27 July 2026
  4. Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic accessLumen Black Lotus Labs · 28 Oct 2026
  5. Volt Typhoon hides zero-day attacks using 'Silent Train' frameworkBleepingComputer · 28 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from July 2026 · JSON · RSS