CVE-2026-16812Vulnerability

Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on 27 Jul 2026.

Reported by 5 independent sources · first reported 7 Aug 2026 by Recorded Future · last reported 24 Oct 2026

Last reported today

CISA KEVAdded 27 Jul 2026
Fix due 30 Jul 2026
Used by ransomware: not knownCISA KEV catalogue

EPSS1.0%
higher than 62% of CVEsFIRST EPSS, as of 23 Oct 2026

What the reports say

7 reports, newest first · the exact sentence from each

“CVE-2026-114625 is the third vulnerability in the same product to have been weaponized in the wild since July 2026, following CVE-2026-16812 (CVSS score: 10.0) and CVE-2026-93952 (CVSS score: 10.0).”

The Hacker NewsNews24 Oct 2026
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
“CVE-2026-114625 is the third exploited zero-day vulnerability Arista patches in VCO in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September.”

SecurityWeekNews23 Oct 2026
Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months
“CVE-2026-114625 is the third actively exploited VCO vulnerability Arista has disclosed since July, following CVE-2026-16812 and CVE-2026-93952.”

SOCRadarVendor23 Oct 2026
CVE-2026-114625: Actively Exploited VeloCloud Orchestrator Flaw Grants Superuser Access
“Neither the July flaw (CVE-2026-16812) nor the September flaw (CVE-2026-93952) needed one.”

The Hacker NewsNews22 Oct 2026
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
“CVE-2026-16812 A command injection vulnerability in Arista VeloCloud Orchestrator that allows a threat actor to perform arbitrary OS command execution with root privileges.”

AhnLab ASECVendor6 Oct 2026
Q3 2026 Vulnerability Trend Report
“July flaw (CVE-2026-16812) fixed in”

The Hacker NewsNews22 Sep 2026
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
“CVE-2026-16812”

Recorded FutureVendor7 Aug 2026
July 2026 CVE Landscape

Indicators reported together

named in the same reports

6.1.3[.]10in 4 reports
6.4.2[.]12in 4 reports
74.82.197[.]86in 4 reports
38.54.50[.]151in 4 reports
5.2.3[.]16in 2 reports
6.1.3[.]7in 2 reports
6.4.2[.]8in 2 reports
5.2.3[.]18in 2 reports

Copy these 8 indicators · defanged

8 indicators, defanged, one per line

6.1.3[.]10
6.4.2[.]12
74.82.197[.]86
38.54.50[.]151
5.2.3[.]16
6.1.3[.]7
6.4.2[.]8
5.2.3[.]18

Also named with it: CVE-2026-93952, CVE-2026-114625, CVE-2026-50522, CVE-2025-49113, CVE-2026-33824, CVE-2024-42009, CVE-2026-15409, CVE-2026-15410, CVE-2026-25089, CVE-2026-39808, CVE-2026-42897, CVE-2025-55182

Thanks — we review every report.

Report a wrong value