Loading story…
Arista has disclosed and patched CVE-2026-16812, a maximum-severity OS command injection flaw in VeloCloud Orchestrator (VCO) On-Prem that is being actively exploited in the wild. The vulnerability lets a remote, unauthenticated attacker with network access to the VCO web interface reach privileged internal functionality that was intended only for internal use, potentially compromising the confidentiality, integrity, and availability of the orchestrator and the data it manages. The issue is tracked as CWE-78 and carries a CVSS 3.1 score reflecting complete impact across all three security pillars.
Affected releases include 5.2.x before 5.2.3.14, 6.1.x before 6.1.3.4, 6.4.x before 6.4.2.4, and 7.0.x before 7.0.0.1. Arista said its Hosted and Dedicated VCO deployments were patched before public disclosure and are not affected, but warned that patching alone may not be enough if an instance was already compromised because attackers could also gain access to managed VeloCloud Edge devices. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and directed U.S. federal civilian agencies to remediate it by July 30, 2026, while Arista has published indicators of compromise to support incident response.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog, reflecting active exploitation. The reference also says federal civilian executive branch agencies were ordered to mitigate the issue by July 30, 2026.
Alongside its disclosure, Arista published indicators of compromise for CVE-2026-16812 and warned that patching alone may not fully remediate already-breached VCO instances. The company said attackers could also gain access to managed VeloCloud Edge devices after compromise.
Arista disclosed and patched CVE-2026-16812, a maximum-severity unauthenticated OS command injection flaw affecting on-premises VeloCloud Orchestrator deployments. The company said the vulnerability was being actively exploited in the wild and published affected version ranges.
Arista stated that VeloCloud Orchestrator Hosted and Dedicated versions were patched before the public notice for CVE-2026-16812 was published. The references do not provide a specific date for when those patches were applied.
Fortinet disclosed an information exposure vulnerability in FortiOS SSL-VPN that lets an unauthenticated attacker bypass a prior patch for the symbolic link persistence mechanism using crafted HTTP requests, but only after a device was already compromised and read-only filesystem access was obtained. The company listed affected FortiOS branches, provided fixed versions and upgrade guidance, and said a virtual patch named FG-VD-60389.0day was available in FMWP database update 26.033.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
17 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcearista.com
Open sourcefortiguard.fortinet.com
Open sourcesdxcentral.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Arista Networks released urgent fixes for **CVE-2026-93952**, a CVSS 10.0 improper-input-validation flaw in on-premises VeloCloud Orchestrator (VCO) that has been exploited as a zero-day. An attacker with network access to the VCO web interface and the public portion of a VeloCloud Edge authentication certificate can reach privileged internal functionality without tenant or operator credentials, potentially compromising the confidentiality, integrity, and availability of the orchestrator and managed data. Affected versions include VCO 5.2.0–5.2.3.15, 6.1.0–6.1.3.7, 6.4.0–6.4.2.7, and 7.0.0–7.0.0.2; fixes are available in 5.2.3.16 and 6.4.2.8, with other release-train patches pending. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring U.S. federal agencies to remediate within three days. Administrators should apply Arista updates immediately and investigate VCO hosts for published indicators, including malicious files, a `vc-sysmond` implant, unauthorized systemd services, and suspicious source IPs in nginx logs. Rapid7 has proposed detection-only Metasploit modules to fingerprint potentially affected VCO interfaces and conduct local read-only IOC checks; the project cautions that a favicon can identify VCO but cannot reliably establish its version remotely, and exploitation also requires Edge-to-VCO certificate material.
Sep 23, 2026
CISA updated its Known Exploited Vulnerabilities catalog to add **CVE-2026-16812**, a critical `CVSS 10.0` OS command injection flaw in **Arista VeloCloud Orchestrator On-Prem**, and reporting also identified the addition of **CVE-2025-68686** in **Fortinet FortiOS**. The Arista issue can expose privileged internal functionality and allow remote compromise of the underlying orchestrator host, affecting the confidentiality, integrity, and availability of the platform and managed data. VMware and Arista said the VeloCloud vulnerability is being actively exploited in the wild. The Fortinet flaw is an information disclosure issue that can be abused by an attacker who already has filesystem-level access to bypass symbolic-link protections and continue accessing sensitive resources. CISA directed agencies to apply vendor mitigations and follow Binding Operational Directive requirements on accelerated timelines, while defenders were urged to identify exposed deployments, patch affected systems immediately, review logs for signs of compromise, and prioritize internet-facing management infrastructure tied to KEV-listed vulnerabilities.
Jul 29, 2026
Broadcom issued advisory **VMSA-2026-0001** for **VMware Aria Operations** (formerly *vRealize Operations*), warning of three vulnerabilities affecting Aria Operations and bundled platforms including **VMware Cloud Foundation** and **VMware Telco Cloud**. The most severe issue, **CVE-2026-22719** (CVSS 8.1), is a **command injection** flaw that can be exploited by an **unauthenticated** attacker to execute arbitrary commands and potentially achieve **remote code execution** specifically **while a support-assisted product migration is in progress**. Broadcom released patches and also documented a workaround for CVE-2026-22719 in its response matrix/KB guidance. The advisory also covers **CVE-2026-22720** (CVSS 8.0), a **stored XSS** issue where a user with privileges to create custom benchmarks can inject script to perform administrative actions, and **CVE-2026-22721** (CVSS 6.2), a **privilege escalation** path where a user with vCenter access to Aria Operations can elevate to administrative control. Researchers **Sven Nobis** and **Lorin Lehawany** of **ERNW** were credited with reporting at least part of the findings. Impacted deployments include Aria Operations 8.x and related bundles across Cloud Foundation and Telco Cloud product lines; Broadcom’s fixed versions include updates such as Aria Operations **8.18.6** and Cloud Foundation **9.0.2.0**, and organizations are advised to prioritize upgrades due to the lack of workarounds for the XSS and privilege-escalation issues.
Jun 29, 2026