Database/Control plane, storage & DevOps

VeloCloud Orchestrator On-Prem: internal functionality reachable remotely, orchestrator host compromise

CVSS 10.0CVE-2026-16812Control plane, storage & DevOpsKnown exploitedcurated

Impact

Functionality the vendor intended for internal use only is reachable by a remote attacker, who can use it to reach privileged internal behavior and affect the orchestrator host. The advisory states confidentiality, integrity and availability of the orchestrator and of the data it manages may all be compromised, which for an operator means the device managing site-to-site connectivity and its configuration database. CISA lists it as actively exploited. Hosted and dedicated VeloCloud instances were patched before the notice; only on-prem deployments need operator action.

Who can reach it

Remote and unauthenticated - the CVSS 4.0 vector is AV:N/PR:N/UI:N. Anyone who can reach the orchestrator's network interface, which in many deployments is a management network but is sometimes internet-facing.

What to do

Apply the fixed VCO On-Prem release named in Arista security advisory 0144 and restart the orchestrator; the advisory is the authority on exact versions, which the NVD record does not list. Because this is on the KEV list, treat it as an emergency window, and after patching hunt for prior compromise - the orchestrator host and its managed data should be assumed touched if it was exposed. Restrict reachability of the orchestrator to the management network in the meantime.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-16812 https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.