Arista VeloCloud Orchestrator RCE Flaw Actively Exploited (CVE-2026-16812)

Tue, 28 Jul 2026 13:01:43 +0000

Engineer — Act: CVE-2026-16812 (CVSS 10.0) is CISA KEV-listed with a public PoC and confirmed active exploitation — patch on-premises VeloCloud Orchestrator to the vendor-fixed version immediately and treat any unpatched instance as potentially compromised.
SOC/IR — Act: Active exploitation of this RCE means on-prem VCO hosts should be treated as assume-breach candidates; hunt for anomalous process execution or outbound connections originating from VeloCloud Orchestrator nodes and sweep for IOCs since the date public PoC became available.
Leader — Act: Confirm whether the organization runs on-premises VeloCloud Orchestrator and if so escalate to an emergency patch cycle this week; a CVSS 10.0 SD-WAN orchestration flaw on the CISA KEV list under active exploitation is a board-question-level event for enterprises relying on it for network management.
Signals: CVE-2026-16812 — CISA KEV: listed, EPSS n/a, public PoC on GitHub

Sd-Wan on CuraSec