CVE-2026-16812: VeloCloud Orchestrator On-Premises Remote Privilege Access
Severity: CRITICAL (CVSS 10.0)
KEV Status: Actively exploited
Affected Products:
- VeloCloud Orchestrator (VCO) on-premises deployments only
Vulnerability: Remote attacker can access privileged internal functionality intended for internal use only, potentially compromising confidentiality, integrity, and availability of the orchestrator and managed data.
Remediation:
- VCO hosted and dedicated versions have been patched
- On-premises deployments require immediate patching; consult Arista security advisory for patch availability and deployment instructions
- Reference: https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144
Action Required: Prioritize patching on-premises VCO instances immediately.