CVE-2026-16812

Successful exploitation can compromise the confidentiality, integrity, and availability of the orchestrator host and its managed data. Commands execute with the VCO service account's privileges and may permit installation of malicious software, data theft or modification, account creation, and service disruption. Orchestrator compromise can expose SD-WAN configurations, administrative credentials, certificates, cryptographic keys, and management databases. Attackers may also use the orchestrator's trusted management position to access managed VeloCloud Edge devices or distribute unauthorized routing, firewall, VPN, and certificate changes, potentially disrupting connectivity across multiple sites. Edge and Gateway appliances are not directly vulnerable to this flaw.

Until patching is complete, restrict access to the VCO web interface to trusted administrative networks using upstream firewalls, allowlists, VPN access, or dedicated management networks. No VCO configuration eliminates the underlying vulnerability. Review web access, backend application, system, and database logs for suspicious requests, unexpected command execution, unauthorized administrative or configuration changes, and abnormal outbound connections. Preserve relevant logs and file-system timestamps when compromise is suspected. Network restrictions reduce exposure but do not replace the vendor update.

Immediately upgrade affected VCO On-Prem deployments to a fixed release within the corresponding branch: 5.2.3.14 or later for 5.2.x, 6.1.3.4 or later for 6.1.x, 6.4.2.4 or later for 6.4.x, and 7.0.0.1 or later for 7.0.x. Investigate potentially exposed deployments for prior exploitation; patching alone does not remove an existing compromise. If compromise is suspected, preserve evidence before remediation where feasible, rotate exposed credentials and cryptographic material, remove unauthorized persistence or restore from trusted sources, and validate managed Edge device configurations and state.