This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Arista fixes an actively exploited vulnerability

Arista fixes two critical and one high-severity vulnerability in VeloCloud Orchestrator (VCO) On-Prem in versions 5.2.3.14, 6.1.3.4 and 6.4.2.4. If an immediate update to a fixed version is not possible, the risk can be temporarily mitigated by restricting access to the VCO web interface to trusted networks only. It is also recommended to monitor for unusual network traffic and recent administrator activity. [1][2]

Arista - OS Command Execution (CVE-2026-16812)
CVSS 10.0 (Critical)

An unauthenticated remote attacker can, via the VCO web interface, gain unauthorized access to privileged internal functionality and execute arbitrary commands at the operating system level, thereby potentially gaining full control over the orchestrator and the managed data as well as access to connected VeloCloud Edge devices [1]. The vulnerability is already being actively exploited and has been added to the CISA KEV catalog [3]. IoCs have been published for it, and in case of compromise, password rotation, a review of managed devices and restoring the orchestrator from a trusted backup are recommended [1].

The vulnerability is present in product:

  • VeloCloud Orchestrator On-Prem; >=5.2.0, <5.2.3.14; >=6.1.0, <6.1.3.4; >=6.4.0, <6.4.2.4; >=7.0.0, <7.0.0.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

IOC: 8.19.75.217, 206.72.242.124, 206.72.242.162

More information:

  • CVE-2026-16812 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 27. 7. 2026.

Arista - SQLi, SSRF (CVE-2026 -17191)
CVSS 9.1 (Critical)

An authenticated remote attacker with Enterprise Read Only privileges or higher can perform SQLi in the metrics API and potentially carry out an SSRF attack [2].

The vulnerability is present in product:

  • VeloCloud Orchestrator On-Prem; >=5.2.0, <5.2.3.14; >=6.1.0, <6.1.3.4; >=6.4.0, <6.4.2.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

More information:

  • CVE-2026-17191 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 27. 7. 2026.

Arista - SSRF (CVE-2026-17192)
CVSS 8.5 (High)

An authenticated remote attacker with Enterprise Standard Admin privileges or higher can send requests on behalf of other authenticated accounts to otherwise inaccessible services [2].

The vulnerability is present in product:

  • VeloCloud Orchestrator On-Prem; >=5.2.0, <5.2.3.14; >=6.1.0, <6.1.3.4; >=6.4.0, <6.4.2.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

More information:

The vulnerability was publicly disclosed 27. 7. 2026.

By CESNET, z.s.p.o. Táňa Macháčková on 28. 7. 2026.

CESNET, z.s.p.o. Logo