Velocloud Orchestrator

2 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2026-16812 Jul 27, 16:17 CRITICAL POC KEV PATCH THREAT Act Now

Command injection vulnerability in VeloCloud Orchestrator (VCO) on-premises allows unauthenticated remote attackers to access internal functionality and fully compromise the host system, impacting data managed by the orchestrator. This issue is known to be actively exploited. Hosted and Dedicated VCO versions have been pre-emptively patched.

Command Injection Velocloud Orchestrator Arista

NVD VulDB

CVSS 4.0

10.0

EPSS

1.0%

Threat

5.0

CVE-2020-3973 Jul 08, 14:15 HIGH This Week

The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

SQLi VMware Velocloud Orchestrator

NVD VulDB

CVSS 3.1

8.8

EPSS

1.1%

CVE-2026-16812

EPSS 1% 5.0 CVSS 10.0

CRITICAL POC KEV PATCH THREAT Act Now

Command Injection Velocloud Orchestrator Arista

NVD VulDB

CVE-2020-3973

EPSS 1% CVSS 8.8

HIGH This Week

SQLi VMware Velocloud Orchestrator

NVD VulDB