SECURITYJul 28 · 04:43 UTCTHE HACKER NEWS[email protected] (The Hacker News)

Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw

A maximum-severity command injection vulnerability (CVE-2026-16812) in on-premises versions of Arista VeloCloud Orchestrator is being actively exploited, allowing arbitrary code execution. The flaw, rated with a CVSS score of 10.0, enables attackers to execute operating system commands through the affected system.

Nexus surfaces and summarizes. The full story lives at the source.

Mentioned

Arista VeloCloud OrchestratororganizationCVE-2026-16812topicoperating system command injectiontopicarbitrary code executiontopic

Spot something wrong with this article?Report a problem →

Forward this

Related Signal

Adjacent reporting

SECURITYJul 27 · 22:49 UTC
Arista patches VeloCloud Orchestrator zero-day exploited in attacks
SECURITYMay 21 · 07:35 UTC
9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros
SECURITYApr 7 · 17:02 UTC
Max severity Flowise RCE vulnerability now exploited in attacks
SECURITYMay 7 · 13:34 UTC
PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage
SECURITYApr 28 · 18:19 UTC
Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push