Arista VeloCloud Orchestrator: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Root-Rechten
WID-SEC-2026-2702 · first 07.08.2026 · updated 07.08.2026 · CVSS 10,0
What it is about
Der Arista VeloCloud Orchestrator (VCO) ist die zentrale Management-Plattform zur Konfiguration, Steuerung und Überwachung eines VeloCloud SD-WAN-Netzwerks. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Arista VeloCloud Orchestrator ausnutzen, um beliebigen Programmcode mit Root-Rechten auszuführen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- beliebigen Programmcode mit Root-Rechten auszuführen
Am I affected?
Affected according to the BSI:
- Arista VeloCloud Orchestrator <5.2.3.14
- Arista VeloCloud Orchestrator <6.1.3.4
- Arista VeloCloud Orchestrator <6.4.2.4
- Arista VeloCloud Orchestrator <7.0.0.1
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Arista VeloCloud Orchestrator 5.2.3.14
- Arista VeloCloud Orchestrator 6.1.3.4
- Arista VeloCloud Orchestrator 6.4.2.4
- Arista VeloCloud Orchestrator 7.0.0.1
Is the vulnerability already being exploited?
- CVE-2026-16812: exploited in the wild according to CISA, in the catalogue since 27.07.2026.
Information and sources
CVE: CVE-2026-16812
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.