Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)

1. Apply Official Security Patches

Refer to the Arista Security Advisory (0144) and apply the recommended software updates immediately to resolve the vulnerability.

2. Temporary Mitigation (Network Segmentation)

If immediate patching is not feasible, implement the following network-level mitigations:

• Restrict External Access: Disable direct internet access to the VCO management and API ports.
• Implement Access Control Lists (ACLs): Restrict access to the VCO administrative interface to trusted internal management networks or dedicated VPN gateways only.

# Example: Restricting access to the VCO HTTPS port (443) using iptables
iptables -A INPUT -p tcp -s 10.0.0.0/8 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

CVE-2026-16812 is a critical security vulnerability (CVSS 10.0) affecting the on-premises version of VeloCloud Orchestrator (VCO). The root cause lies in the exposure of internal-use-only administrative functionalities to remote networks without proper authentication or access control enforcement.

An attacker can exploit this vulnerability by sending crafted network requests to bypass authentication and perform OS Command Injection (CWE-78) on the underlying host. This allows full remote code execution with root privileges on the orchestrator. Given the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), the exploit requires no privileges or user interaction. This vulnerability is actively being exploited in the wild and is listed in the CISA KEV catalog, making immediate remediation mandatory.