VeloCloud Orchestrator RCE Actively Exploited
An unauthenticated remote code execution flaw in Arista's VeloCloud Orchestrator SD-WAN platform is being actively exploited in the wild.
CVE-2026-16812 affects VeloCloud Orchestrator (VCO) On-Prem, the centralized management platform used to configure and monitor SD-WAN/SASE deployments across enterprise edges and gateways. The flaw allows a remote, unauthenticated attacker with mere network access to the VCO web interface to reach privileged internal functionality, execute arbitrary commands, and potentially take full control of the host—including installing programs, manipulating data, and creating accounts with full user rights. Notably, vulnerable versions are exposed by default and this exposure cannot be mitigated through configuration changes, making patching the only viable remediation path.
The vendor has confirmed active exploitation and MS-ISAC has published three IP addresses observed conducting attacks against VCO instances. Affected versions span VCO 5.2.x prior to 5.2.3.14, 6.1.x prior to 6.1.3.4, 6.4.x prior to 6.4.2.4, and 7.0.x prior to 7.0.0.1. Given the pre-authentication nature of the exploit and confirmed in-the-wild activity, organizations running on-prem VCO should prioritize immediate patching, network segmentation to limit exposure of the management interface, and monitoring for the published indicators.
Mentioned in this report
Detection guidance
VeloCloud Orchestrator Web Process Spawning Command Shell
Detects the VCO Java/Tomcat orchestrator service process spawning a shell or interpreter, consistent with post-exploitation command execution via the unauthenticated RCE in CVE-2026-16812. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: VeloCloud Orchestrator Web Process Spawning Command Shell
description: Detects the VeloCloud Orchestrator (VCO) Java/Tomcat service process
spawning a shell interpreter. VCO is normally a self-contained Java/Tomcat web application
and should not launch shells during normal operation; this pattern is consistent
with exploitation of the pre-auth RCE (CVE-2026-16812) reaching privileged internal
functionality and executing arbitrary commands.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- java
- tomcat
ParentCommandLine|contains:
- velocloud
- vco
- orchestrator
Image|endswith:
- /bin/sh
- /bin/bash
- /bin/dash
- /bin/ksh
filter_known_admin_scripts:
CommandLine|contains:
- /opt/vmware/bin/backup.sh
- /opt/vmware/bin/healthcheck.sh
condition: selection and not filter_known_admin_scripts
falsepositives:
- Legitimate VCO maintenance or backup scripts invoked by the application through
a wrapper shell
- Vendor-supplied diagnostic tooling that shells out from the Java process during
support sessions
level: high
id: e1efc3be-c4dd-5b01-bfcc-09e4626cfac4
status: experimental
author: Vorant
Local Account Creation from VeloCloud Orchestrator Process Tree
Detects account creation or privilege-escalation commands (useradd, usermod, adduser to admin/sudo groups) launched from the VCO web application process tree, matching the reported post-exploitation capability to create accounts with full user rights. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Local Account Creation from VeloCloud Orchestrator Process Tree
description: Detects useradd/usermod/adduser or group-modification commands whose
parent process chain originates from the VeloCloud Orchestrator (VCO) Java/Tomcat
service. The report notes that exploitation of CVE-2026-16812 can be used to create
accounts with full user rights; a management-plane web application spawning account-management
utilities is anomalous and warrants investigation.
tags:
- attack.persistence
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- java
- tomcat
ParentCommandLine|contains:
- velocloud
- vco
- orchestrator
Image|endswith:
- /useradd
- /adduser
- /usermod
- /groupadd
- /gpasswd
CommandLine|contains:
- sudo
- wheel
- admin
- root
condition: selection
falsepositives:
- Configuration management agents (Ansible, Puppet) that manage local accounts through
the application's service account context
- Vendor-supported provisioning scripts executed during initial VCO setup
level: high
id: 10391474-f873-5408-9856-a3d19ed75322
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-velocloud-orchestrator-vco-on-prem-could-allow-for-remote-code-execution_2026-072
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free