HIGHVulnerability
Verified
Global

CISA KEV: Arista VeloCloud Orchestrator — Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

Analysis

Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Added to CISA Known Exploited Vulnerabilities catalog on 2026-07-27. Remediation due: 2026-07-30.

Indicators of Compromise (1)

CVE (1)
CVE-2026-16812
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Jul 27, 2026. Verified by: CISA.

Related Threats

LOWVulnerability

UK court rejects Bahrain immunity claim in spyware case

The alleged hacking by officials in Bahrain “allowed access to and exfiltration of information on the computers, interception of communications conducted using the computers and use of the computers’ microphones and cameras to surveil the respondents,” according to the court opinion.

The Record
MEDIUMVulnerability

Outage leaves UK bank customers unable to make payments

Customers of several UK banks, including Lloyds and Barclays, reported problems with making online payments on Monday.

Finextra
MEDIUMVulnerability

Detection Opportunities for Certighost (CVE-2026-54121)

[object Object]

CVE-2026-54121
r/blueteamsec