Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw

Tuesday, July 28, 2026 at 04:43 AM UTC·Source: The Hacker News

Updated: Tuesday, July 28, 2026 at 06:00 AM UTC

Executive Summary

A maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-16812 (CVSS score: 10.0), is a case of operating system command injection that could pave the way for arbitrary code execution. "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-16812

NVD MITRE CVE

Source Attribution

Originally published by The Hacker News on Jul 28, 2026.

Related Threats

MEDIUMVulnerabilityNEW

Zimbabwe regulator approves seven fintechs for sandbox

The Securities and Exchange Commission of Zimbabwe has given the green light to a number of fintechs seeking to participate in its regulatory sandbox.

6m agoFinextra

MEDIUMVulnerabilityNEW

New CREST AI Standards to Deliver AI-Enabled Pentesting Accreditation

CREST’s new AI standards are optional add-on requirements for cybersecurity service providers wishing to demonstrate responsible AI usage

9m agoInfosecurity Magazine

CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-15014 — The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart ...

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegistration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']` boolean flag as the sole gate before

CVE-2026-15014

49m agoNIST NVD