External risk intelligence

VeloCloud Orchestrator Remote Privileged Access Vulnerability.

CVE advisoryKnown Exploit

CVE-2026-16812

The VeloCloud Orchestrator is a management platform intended for internal administrative use. While the vulnerability allows for remote access to privileged functionality, the product is not designed to be public-facing, and such systems are typically restricted to internal network segments or management interfaces not exposed to the public internet.

OS Command Injection

Arista Velocloud Orchestrator

5.2.0 to before 5.2.3.146.1.0 to before 6.1.3.46.4.0 to before 6.4.2.47.0.0

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security issue has been identified in the on-premise VeloCloud Orchestrator that could allow unauthorized remote access to sensitive internal functions, potentially compromising the orchestrator and its managed data. While hosted and dedicated versions have been patched, on-premise installations require attention, especially given that the vulnerability is actively exploited and was discovered externally.

Unpatched on-premise systems allow remote privileged access.
Actively exploited vulnerability impacts confidential data.
Confirm relevance and exposure for on-premise deployments.

Attack Path

How an attacker could exploit the issue

An attacker can reach privileged internal functionality within the VeloCloud Orchestrator by leveraging an unauthenticated network-accessible feature. This functionality, intended only for internal use, can be triggered remotely, potentially leading to a compromise of the orchestrator's confidentiality, integrity, and availability, as well as the data it manages.

Entry: Unauthenticated network access required.
Trigger: Remote access to internal functionality.
Risk: Compromise of orchestrator and data.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could access privileged internal functionality, potentially impacting the VeloCloud Orchestrator host. This could compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages.

Orchestrator host and managed data at risk.
Unauthenticated remote access to internal functions.
Compromise of orchestrator's confidentiality, integrity, availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

The on-premises VeloCloud Orchestrator (VCO) is impacted by this critical vulnerability, which could allow remote attackers to access privileged internal functions and compromise the orchestrator and its managed data. Given that hosted and dedicated VCO versions have been patched, the immediate priority for on-premises deployments is to identify all instances, confirm their network exposure and business criticality, and engage the accountable owner for remediation planning.

Identify on-prem VCO instances and owners.
Verify network exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the VeloCloud Orchestrator?

VeloCloud Orchestrator (VCO) is a central management platform used to configure, monitor, and maintain wide-area network environments. It serves as the administrative command center for orchestrating connectivity and policy across distributed network sites, acting as the brain for the entire deployment's infrastructure.

What is the weakness class in CVE-2026-16812?

The vulnerability involves improper neutralization of special elements used in an OS command, classified as CWE-78 (OS Command Injection). This means an attacker can force the system to execute unauthorized commands or access sensitive internal functions that were intended to be restricted to administrative users only.

How is this vulnerability triggered?

An attacker triggers this by remotely accessing network-facing functions within the VeloCloud Orchestrator that were meant for internal use only. Because this feature does not require authentication, the bug is not triggered by user-initiated actions; rather, it allows an unauthenticated remote party to interact with privileged system components.

Is my on-premise system at risk per Halo Surface Signal?

Halo Surface Signal notes that VeloCloud Orchestrator is designed for internal administrative use, not public exposure. However, if your instance is inadvertently reachable from the internet, it is at higher risk. Systems kept on isolated management networks or behind strict access controls are less likely to be directly accessible to remote attackers.

What are the first steps to secure my installation?

Immediately identify all on-premise VeloCloud Orchestrator instances in your environment. Verify their network reachability to ensure they are not exposed to the public internet, and coordinate with the system owners to prioritize and apply the necessary updates or security patches provided by the vendor to remediate this critical risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.