Is there a public PoC exploit available for CVE-2026-16812?

Yes, a public proof-of-concept exploit is available for CVE-2026-16812. Prioritise patching immediately. EPSS: 1.0%.

Is there a patch available for CVE-2026-16812?

Yes, a patch is available for CVE-2026-16812. Update the affected software to the latest version immediately.

Velocloud Orchestrator CVE-2026-16812

Q: What is the CVSS score of CVE-2026-16812?

CVE-2026-16812 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

EUVD-2026-49334 CRITICAL

OS Command Injection (CWE-78)

2026-07-27 psirt@arista.com

GHSA-f2cp-q2qv-6563

Command Injection Velocloud Orchestrator Arista

10.0

CVSS 4.0 · Vendor: arista

Severity by source

Vendor (arista) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (arista) · only source for this CVE.

CVSS VectorVendor: arista

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Added to CISA KEV

Jul 27, 2026 - 19:32 CISA

Patch available

Jul 27, 2026 - 17:02 EUVD

Analysis Generated

Jul 27, 2026 - 16:30 vuln.today

CVE Published

Jul 27, 2026 - 16:17 cve.org

CRITICAL 10.0

DescriptionCVE.org

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

This functionality was intended to be for internal use only and is not intended to be remotely accessible.

Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out.

This issue was discovered externally and is known to be actively exploited.

AnalysisAI

Command injection vulnerability in VeloCloud Orchestrator (VCO) on-premises allows unauthenticated remote attackers to access internal functionality and fully compromise the host system, impacting data managed by the orchestrator. This issue is known to be actively exploited. Hosted and Dedicated VCO versions have been pre-emptively patched.