Search
Find a vulnerability
Search criteria
6 vulnerabilities found for VeloCloud Orchestrator On-Prem by Arista Networks
CVE-2026-17192 (GCVE-0-2026-17192)
Vulnerability from nvd – Published: 2026-07-27 16:36 – Updated: 2026-07-27 17:28
VLAI
EPSS
VEX
Title
VeloCloud Orchestrator Missing Input Validation SSRF
Summary
A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Orchestrator On-Prem |
Affected:
5.2.0 , < 5.2.3.14
(custom)
Affected: 6.1.0 , < 6.1.3.4 (custom) Affected: 6.4.0 , < 6.4.2.4 (custom) |
Date Public
2026-07-27 16:15
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17192",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T17:28:28.227511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:28:36.203Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VeloCloud Orchestrator On-Prem",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "5.2.3.14",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThan": "6.1.3.4",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "6.4.2.4",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA successful attack requires a valid authenticated session on the VCO portal. The minimum role required is \u003cstrong\u003eEnterprise Standard Admin\u003c/strong\u003e. No non-default configuration is required.\u003c/p\u003e"
}
],
"value": "A successful attack requires a valid authenticated session on the VCO portal. The minimum role required is Enterprise Standard Admin. No non-default configuration is required."
}
],
"datePublic": "2026-07-27T16:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin.\u003c/p\u003e\n\u003cp\u003eThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.\u003c/p\u003e"
}
],
"value": "A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin.\n\n\n\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664: Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T16:36:32.879Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0145",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\u003c/p\u003e\u003cdiv\u003eThese vulnerabilities have been fixed in the following releases:\u003c/div\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cul\u003e\u003cli\u003eVCO\u0026nbsp;\u003cb\u003e5.2.3.14\u003c/b\u003e\u0026nbsp;and later in the 5.2 train\u003c/li\u003e\u003cli\u003eVCO\u0026nbsp;\u003cb\u003e6.1.3.4\u003c/b\u003e\u0026nbsp;and later in the 6.1 train\u003c/li\u003e\u003cli\u003eVCO\u0026nbsp;\u003cb\u003e6.4.2.4\u003c/b\u003e\u0026nbsp;and later in the 6.4 train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\n\nThese vulnerabilities have been fixed in the following releases:\n\n\u00a0\n\n * VCO\u00a05.2.3.14\u00a0and later in the 5.2 train\n * VCO\u00a06.1.3.4\u00a0and later in the 6.1 train\n * VCO\u00a06.4.2.4\u00a0and later in the 6.4 train"
}
],
"source": {
"advisory": "145",
"defect": [
"BUG 1568526"
],
"discovery": "INTERNAL"
},
"title": "VeloCloud Orchestrator Missing Input Validation SSRF",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a fixed VCO release as soon as it is available. For VCOs which are not on a supported release train, customers can contact TAC to discuss possible upgrade options for your release.\u003c/p\u003e\n\u003cp\u003eUntil the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRestrict access to the VCO web interface to trusted administrative networks.\u003c/li\u003e\n\u003cli\u003eMonitor the VCO for accesses from known malicious source IPs.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected outbound network activity from the VCO host.\u003c/li\u003e\n\u003cli\u003eReview recent administrator activity for unexpected changes.\u003c/li\u003e\n\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a fixed VCO release as soon as it is available. For VCOs which are not on a supported release train, customers can contact TAC to discuss possible upgrade options for your release.\n\n\n\n\nUntil the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\n\n\n\n * Restrict access to the VCO web interface to trusted administrative networks.\n\n * Monitor the VCO for accesses from known malicious source IPs.\n\n * Monitor for unexpected outbound network activity from the VCO host.\n\n * Review recent administrator activity for unexpected changes."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-17192",
"datePublished": "2026-07-27T16:36:32.879Z",
"dateReserved": "2026-07-24T19:03:16.141Z",
"dateUpdated": "2026-07-27T17:28:36.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17191 (GCVE-0-2026-17191)
Vulnerability from nvd – Published: 2026-07-27 16:41 – Updated: 2026-07-27 17:29
VLAI
EPSS
VEX
Title
VeloCloud Orchestrator Flow Metrics API SQL Injection
Summary
An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Orchestrator On-Prem |
Affected:
5.2.0 , < 5.2.3.14
(custom)
Affected: 6.1.0 , < 6.1.3.4 (custom) Affected: 6.4.0 , < 6.4.2.4 (custom) |
Date Public
2026-07-27 16:37
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17191",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T17:29:37.640962Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:29:45.538Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VeloCloud Orchestrator On-Prem",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "5.2.3.14",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThan": "6.1.3.4",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "6.4.2.4",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA successful attack requires a valid authenticated session on the VCO portal. The minimum user role required is \u003cstrong\u003eEnterprise Read Only\u003c/strong\u003e, the lowest built-in tenant role. No non-default configuration is required.\u003c/p\u003e"
}
],
"value": "A successful attack requires a valid authenticated session on the VCO portal. The minimum user role required is Enterprise Read Only, the lowest built-in tenant role. No non-default configuration is required."
}
],
"datePublic": "2026-07-27T16:37:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.\u003c/p\u003e\n\u003cp\u003eThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.\u003c/p\u003e"
}
],
"value": "An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.\n\n\n\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66: SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T16:41:17.436Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0145",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\u003c/p\u003e\n\u003cp\u003eThese vulnerabilities have been fixed in the following releases:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVCO \u003cstrong\u003e5.2.3.14\u003c/strong\u003e and later in the 5.2 train\u003c/li\u003e\n\u003cli\u003eVCO \u003cstrong\u003e6.1.3.4\u003c/strong\u003e and later in the 6.1 train\u003c/li\u003e\n\u003cli\u003eVCO \u003cstrong\u003e6.4.2.4\u003c/strong\u003e and later in the 6.4 train\u003c/li\u003e\n\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\n\n\n\n\nThese vulnerabilities have been fixed in the following releases:\n\n\n\n * VCO 5.2.3.14 and later in the 5.2 train\n\n * VCO 6.1.3.4 and later in the 6.1 train\n\n * VCO 6.4.2.4 and later in the 6.4 train"
}
],
"source": {
"advisory": "145",
"defect": [
"BUG 1568507"
],
"discovery": "INTERNAL"
},
"title": "VeloCloud Orchestrator Flow Metrics API SQL Injection",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUntil the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRestrict access to the VCO web interface to trusted administrative networks.\u003c/li\u003e\n\u003cli\u003eMonitor the VCO for accesses from known malicious source IPs.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected outbound network activity from the VCO host.\u003c/li\u003e\n\u003cli\u003eReview recent administrator activity for unexpected changes.\u003c/li\u003e\n\u003c/ul\u003e"
}
],
"value": "Until the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\n\n\n\n * Restrict access to the VCO web interface to trusted administrative networks.\n\n * Monitor the VCO for accesses from known malicious source IPs.\n\n * Monitor for unexpected outbound network activity from the VCO host.\n\n * Review recent administrator activity for unexpected changes."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-17191",
"datePublished": "2026-07-27T16:41:17.436Z",
"dateReserved": "2026-07-24T19:03:13.728Z",
"dateUpdated": "2026-07-27T17:29:45.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16812 (GCVE-0-2026-16812)
Vulnerability from nvd – Published: 2026-07-27 16:11 – Updated: 2026-07-28 03:56Title
VeloCloud Orchestrator OS Command Injection
Summary
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
This functionality was intended to be for internal use only and is not intended to be remotely accessible.
Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out.
This issue was discovered externally and is known to be actively exploited.
Severity
10 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Orchestrator On-Prem |
Affected:
5.2.0 , < 5.2.3.14
(custom)
Affected: 6.1.0 , < 6.1.3.4 (custom) Affected: 6.4.0 , < 6.4.2.4 (custom) Affected: 7.0.0 , < 7.0.0.1 (custom) |
Date Public
2026-07-27 16:07
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16812",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-07-27",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T03:56:40.567Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-27T00:00:00.000Z",
"value": "CVE-2026-16812 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VeloCloud Orchestrator On-Prem",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "5.2.3.14",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThan": "6.1.3.4",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "6.4.2.4",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.1",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVCO is exposed by default. There is no configuration that can prevent the exposure. A successful attack requires network access to the VCO web interface. VCO tenant or operator credentials are not required for this exposure.\u003c/p\u003e\n\u003cp\u003eDeployments that restrict VCO web interface access to trusted administrative networks can reduce risk of exposure.\u003c/p\u003e"
}
],
"value": "VCO is exposed by default. There is no configuration that can prevent the exposure. A successful attack requires network access to the VCO web interface. VCO tenant or operator credentials are not required for this exposure.\n\n\n\n\nDeployments that restrict VCO web interface access to trusted administrative networks can reduce risk of exposure."
}
],
"datePublic": "2026-07-27T16:07:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\u003c/p\u003e\n\u003cp\u003eThis functionality was intended to be for internal use only and is not intended to be remotely accessible.\u003c/p\u003e\n\u003cp\u003eHosted and Dedicated versions of VCO have already been patched in advance of this notice going out.\u003c/p\u003e\n\u003cp\u003eThis issue was discovered externally and is known to be actively exploited.\u003c/p\u003e"
}
],
"value": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\n\n\n\nThis functionality was intended to be for internal use only and is not intended to be remotely accessible.\n\n\n\n\nHosted and Dedicated versions of VCO have already been patched in advance of this notice going out.\n\n\n\n\nThis issue was discovered externally and is known to be actively exploited."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88: OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T16:11:00.968Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0144",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\u003c/p\u003e\u003cdiv\u003eThis vulnerability has been fixed in the following releases:\u003c/div\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cul\u003e\u003cli\u003eVCO\u0026nbsp;\u003cb\u003e5.2.3.14\u003c/b\u003e\u0026nbsp;and later in the 5.2 train\u003c/li\u003e\u003cli\u003eVCO\u0026nbsp;\u003cb\u003e6.1.3.4\u003c/b\u003e\u0026nbsp;and later in the 6.1 train\u003c/li\u003e\u003cli\u003eVCO\u0026nbsp;\u003cb\u003e6.4.2.4\u003c/b\u003e\u0026nbsp;and later in the 6.4 train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\n\nThis vulnerability has been fixed in the following releases:\n\n\u00a0\n\n * VCO\u00a05.2.3.14\u00a0and later in the 5.2 train\n * VCO\u00a06.1.3.4\u00a0and later in the 6.1 train\n * VCO\u00a06.4.2.4\u00a0and later in the 6.4 train"
}
],
"source": {
"advisory": "144",
"defect": [
"BUG 1901675"
],
"discovery": "EXTERNAL"
},
"title": "VeloCloud Orchestrator OS Command Injection",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a fixed VCO release as soon as it is available. For VCOs which are not on a supported release train, customers can contact TAC to discuss possible upgrade options for your release.\u003c/p\u003e\n\u003cp\u003eUntil the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRestrict access to the VCO web interface to trusted administrative networks.\u003c/li\u003e\n\u003cli\u003eMonitor the VCO for accesses from known malicious source IPs.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected outbound network activity from the VCO host.\u003c/li\u003e\n\u003cli\u003eReview recent administrator activity for unexpected changes.\u003c/li\u003e\n\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a fixed VCO release as soon as it is available. For VCOs which are not on a supported release train, customers can contact TAC to discuss possible upgrade options for your release.\n\n\n\n\nUntil the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\n\n\n\n * Restrict access to the VCO web interface to trusted administrative networks.\n\n * Monitor the VCO for accesses from known malicious source IPs.\n\n * Monitor for unexpected outbound network activity from the VCO host.\n\n * Review recent administrator activity for unexpected changes."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-16812",
"datePublished": "2026-07-27T16:11:00.968Z",
"dateReserved": "2026-07-23T21:46:32.558Z",
"dateUpdated": "2026-07-28T03:56:40.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17191 (GCVE-0-2026-17191)
Vulnerability from cvelistv5 – Published: 2026-07-27 16:41 – Updated: 2026-07-27 17:29
VLAI
EPSS
VEX
Title
VeloCloud Orchestrator Flow Metrics API SQL Injection
Summary
An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Orchestrator On-Prem |
Affected:
5.2.0 , < 5.2.3.14
(custom)
Affected: 6.1.0 , < 6.1.3.4 (custom) Affected: 6.4.0 , < 6.4.2.4 (custom) |
Date Public
2026-07-27 16:37
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17191",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T17:29:37.640962Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:29:45.538Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VeloCloud Orchestrator On-Prem",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "5.2.3.14",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThan": "6.1.3.4",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "6.4.2.4",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA successful attack requires a valid authenticated session on the VCO portal. The minimum user role required is \u003cstrong\u003eEnterprise Read Only\u003c/strong\u003e, the lowest built-in tenant role. No non-default configuration is required.\u003c/p\u003e"
}
],
"value": "A successful attack requires a valid authenticated session on the VCO portal. The minimum user role required is Enterprise Read Only, the lowest built-in tenant role. No non-default configuration is required."
}
],
"datePublic": "2026-07-27T16:37:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.\u003c/p\u003e\n\u003cp\u003eThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.\u003c/p\u003e"
}
],
"value": "An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.\n\n\n\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66: SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T16:41:17.436Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0145",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\u003c/p\u003e\n\u003cp\u003eThese vulnerabilities have been fixed in the following releases:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVCO \u003cstrong\u003e5.2.3.14\u003c/strong\u003e and later in the 5.2 train\u003c/li\u003e\n\u003cli\u003eVCO \u003cstrong\u003e6.1.3.4\u003c/strong\u003e and later in the 6.1 train\u003c/li\u003e\n\u003cli\u003eVCO \u003cstrong\u003e6.4.2.4\u003c/strong\u003e and later in the 6.4 train\u003c/li\u003e\n\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\n\n\n\n\nThese vulnerabilities have been fixed in the following releases:\n\n\n\n * VCO 5.2.3.14 and later in the 5.2 train\n\n * VCO 6.1.3.4 and later in the 6.1 train\n\n * VCO 6.4.2.4 and later in the 6.4 train"
}
],
"source": {
"advisory": "145",
"defect": [
"BUG 1568507"
],
"discovery": "INTERNAL"
},
"title": "VeloCloud Orchestrator Flow Metrics API SQL Injection",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUntil the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRestrict access to the VCO web interface to trusted administrative networks.\u003c/li\u003e\n\u003cli\u003eMonitor the VCO for accesses from known malicious source IPs.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected outbound network activity from the VCO host.\u003c/li\u003e\n\u003cli\u003eReview recent administrator activity for unexpected changes.\u003c/li\u003e\n\u003c/ul\u003e"
}
],
"value": "Until the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\n\n\n\n * Restrict access to the VCO web interface to trusted administrative networks.\n\n * Monitor the VCO for accesses from known malicious source IPs.\n\n * Monitor for unexpected outbound network activity from the VCO host.\n\n * Review recent administrator activity for unexpected changes."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-17191",
"datePublished": "2026-07-27T16:41:17.436Z",
"dateReserved": "2026-07-24T19:03:13.728Z",
"dateUpdated": "2026-07-27T17:29:45.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17192 (GCVE-0-2026-17192)
Vulnerability from cvelistv5 – Published: 2026-07-27 16:36 – Updated: 2026-07-27 17:28
VLAI
EPSS
VEX
Title
VeloCloud Orchestrator Missing Input Validation SSRF
Summary
A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Orchestrator On-Prem |
Affected:
5.2.0 , < 5.2.3.14
(custom)
Affected: 6.1.0 , < 6.1.3.4 (custom) Affected: 6.4.0 , < 6.4.2.4 (custom) |
Date Public
2026-07-27 16:15
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17192",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T17:28:28.227511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:28:36.203Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VeloCloud Orchestrator On-Prem",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "5.2.3.14",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThan": "6.1.3.4",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "6.4.2.4",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA successful attack requires a valid authenticated session on the VCO portal. The minimum role required is \u003cstrong\u003eEnterprise Standard Admin\u003c/strong\u003e. No non-default configuration is required.\u003c/p\u003e"
}
],
"value": "A successful attack requires a valid authenticated session on the VCO portal. The minimum role required is Enterprise Standard Admin. No non-default configuration is required."
}
],
"datePublic": "2026-07-27T16:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin.\u003c/p\u003e\n\u003cp\u003eThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.\u003c/p\u003e"
}
],
"value": "A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin.\n\n\n\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664: Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T16:36:32.879Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0145",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\u003c/p\u003e\u003cdiv\u003eThese vulnerabilities have been fixed in the following releases:\u003c/div\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cul\u003e\u003cli\u003eVCO\u0026nbsp;\u003cb\u003e5.2.3.14\u003c/b\u003e\u0026nbsp;and later in the 5.2 train\u003c/li\u003e\u003cli\u003eVCO\u0026nbsp;\u003cb\u003e6.1.3.4\u003c/b\u003e\u0026nbsp;and later in the 6.1 train\u003c/li\u003e\u003cli\u003eVCO\u0026nbsp;\u003cb\u003e6.4.2.4\u003c/b\u003e\u0026nbsp;and later in the 6.4 train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\n\nThese vulnerabilities have been fixed in the following releases:\n\n\u00a0\n\n * VCO\u00a05.2.3.14\u00a0and later in the 5.2 train\n * VCO\u00a06.1.3.4\u00a0and later in the 6.1 train\n * VCO\u00a06.4.2.4\u00a0and later in the 6.4 train"
}
],
"source": {
"advisory": "145",
"defect": [
"BUG 1568526"
],
"discovery": "INTERNAL"
},
"title": "VeloCloud Orchestrator Missing Input Validation SSRF",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a fixed VCO release as soon as it is available. For VCOs which are not on a supported release train, customers can contact TAC to discuss possible upgrade options for your release.\u003c/p\u003e\n\u003cp\u003eUntil the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRestrict access to the VCO web interface to trusted administrative networks.\u003c/li\u003e\n\u003cli\u003eMonitor the VCO for accesses from known malicious source IPs.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected outbound network activity from the VCO host.\u003c/li\u003e\n\u003cli\u003eReview recent administrator activity for unexpected changes.\u003c/li\u003e\n\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a fixed VCO release as soon as it is available. For VCOs which are not on a supported release train, customers can contact TAC to discuss possible upgrade options for your release.\n\n\n\n\nUntil the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\n\n\n\n * Restrict access to the VCO web interface to trusted administrative networks.\n\n * Monitor the VCO for accesses from known malicious source IPs.\n\n * Monitor for unexpected outbound network activity from the VCO host.\n\n * Review recent administrator activity for unexpected changes."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-17192",
"datePublished": "2026-07-27T16:36:32.879Z",
"dateReserved": "2026-07-24T19:03:16.141Z",
"dateUpdated": "2026-07-27T17:28:36.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16812 (GCVE-0-2026-16812)
Vulnerability from cvelistv5 – Published: 2026-07-27 16:11 – Updated: 2026-07-28 03:56Title
VeloCloud Orchestrator OS Command Injection
Summary
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
This functionality was intended to be for internal use only and is not intended to be remotely accessible.
Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out.
This issue was discovered externally and is known to be actively exploited.
Severity
10 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Orchestrator On-Prem |
Affected:
5.2.0 , < 5.2.3.14
(custom)
Affected: 6.1.0 , < 6.1.3.4 (custom) Affected: 6.4.0 , < 6.4.2.4 (custom) Affected: 7.0.0 , < 7.0.0.1 (custom) |
Date Public
2026-07-27 16:07
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16812",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-07-27",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T03:56:40.567Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-27T00:00:00.000Z",
"value": "CVE-2026-16812 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VeloCloud Orchestrator On-Prem",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "5.2.3.14",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThan": "6.1.3.4",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "6.4.2.4",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.1",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVCO is exposed by default. There is no configuration that can prevent the exposure. A successful attack requires network access to the VCO web interface. VCO tenant or operator credentials are not required for this exposure.\u003c/p\u003e\n\u003cp\u003eDeployments that restrict VCO web interface access to trusted administrative networks can reduce risk of exposure.\u003c/p\u003e"
}
],
"value": "VCO is exposed by default. There is no configuration that can prevent the exposure. A successful attack requires network access to the VCO web interface. VCO tenant or operator credentials are not required for this exposure.\n\n\n\n\nDeployments that restrict VCO web interface access to trusted administrative networks can reduce risk of exposure."
}
],
"datePublic": "2026-07-27T16:07:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\u003c/p\u003e\n\u003cp\u003eThis functionality was intended to be for internal use only and is not intended to be remotely accessible.\u003c/p\u003e\n\u003cp\u003eHosted and Dedicated versions of VCO have already been patched in advance of this notice going out.\u003c/p\u003e\n\u003cp\u003eThis issue was discovered externally and is known to be actively exploited.\u003c/p\u003e"
}
],
"value": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\n\n\n\nThis functionality was intended to be for internal use only and is not intended to be remotely accessible.\n\n\n\n\nHosted and Dedicated versions of VCO have already been patched in advance of this notice going out.\n\n\n\n\nThis issue was discovered externally and is known to be actively exploited."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88: OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T16:11:00.968Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0144",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\u003c/p\u003e\u003cdiv\u003eThis vulnerability has been fixed in the following releases:\u003c/div\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cul\u003e\u003cli\u003eVCO\u0026nbsp;\u003cb\u003e5.2.3.14\u003c/b\u003e\u0026nbsp;and later in the 5.2 train\u003c/li\u003e\u003cli\u003eVCO\u0026nbsp;\u003cb\u003e6.1.3.4\u003c/b\u003e\u0026nbsp;and later in the 6.1 train\u003c/li\u003e\u003cli\u003eVCO\u0026nbsp;\u003cb\u003e6.4.2.4\u003c/b\u003e\u0026nbsp;and later in the 6.4 train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\n\nThis vulnerability has been fixed in the following releases:\n\n\u00a0\n\n * VCO\u00a05.2.3.14\u00a0and later in the 5.2 train\n * VCO\u00a06.1.3.4\u00a0and later in the 6.1 train\n * VCO\u00a06.4.2.4\u00a0and later in the 6.4 train"
}
],
"source": {
"advisory": "144",
"defect": [
"BUG 1901675"
],
"discovery": "EXTERNAL"
},
"title": "VeloCloud Orchestrator OS Command Injection",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a fixed VCO release as soon as it is available. For VCOs which are not on a supported release train, customers can contact TAC to discuss possible upgrade options for your release.\u003c/p\u003e\n\u003cp\u003eUntil the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRestrict access to the VCO web interface to trusted administrative networks.\u003c/li\u003e\n\u003cli\u003eMonitor the VCO for accesses from known malicious source IPs.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected outbound network activity from the VCO host.\u003c/li\u003e\n\u003cli\u003eReview recent administrator activity for unexpected changes.\u003c/li\u003e\n\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a fixed VCO release as soon as it is available. For VCOs which are not on a supported release train, customers can contact TAC to discuss possible upgrade options for your release.\n\n\n\n\nUntil the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\n\n\n\n * Restrict access to the VCO web interface to trusted administrative networks.\n\n * Monitor the VCO for accesses from known malicious source IPs.\n\n * Monitor for unexpected outbound network activity from the VCO host.\n\n * Review recent administrator activity for unexpected changes."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-16812",
"datePublished": "2026-07-27T16:11:00.968Z",
"dateReserved": "2026-07-23T21:46:32.558Z",
"dateUpdated": "2026-07-28T03:56:40.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}