VeloCloud Orchestrator RCE Actively Exploited

Published28 July 2026 Vorant ratinghigh vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

An unauthenticated remote code execution flaw in Arista's VeloCloud Orchestrator SD-WAN platform is being actively exploited in the wild.

Sourcecisecurity.org — open the original

What to check

Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation: CISA lists CVE-2026-16812 as exploited in the wild.

CVE-2026-16812 affects VeloCloud Orchestrator (VCO) On-Prem, the centralized management platform used to configure and monitor SD-WAN/SASE deployments across enterprise edges and gateways. The flaw allows a remote, unauthenticated attacker with mere network access to the VCO web interface to reach privileged internal functionality, execute arbitrary commands, and potentially take full control of the host—including installing programs, manipulating data, and creating accounts with full user rights. Notably, vulnerable versions are exposed by default and this exposure cannot be mitigated through configuration changes, making patching the only viable remediation path.

The vendor has confirmed active exploitation and MS-ISAC has published three IP addresses observed conducting attacks against VCO instances. Affected versions span VCO 5.2.x prior to 5.2.3.14, 6.1.x prior to 6.1.3.4, 6.4.x prior to 6.4.2.4, and 7.0.x prior to 7.0.0.1. Given the pre-authentication nature of the exploit and confirmed in-the-wild activity, organizations running on-prem VCO should prioritize immediate patching, network segmentation to limit exposure of the management interface, and monitoring for the published indicators.

Mentioned in this report

Vulnerabilities CVE-2026-16812KEV

Detection guidance

VeloCloud Orchestrator Web Process Spawning Command Shell

ATT&CK T1190 · status experimental · needs linux process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects the VCO Java/Tomcat orchestrator service process spawning a shell or interpreter, consistent with post-exploitation command execution via the unauthenticated RCE in CVE-2026-16812. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: VeloCloud Orchestrator Web Process Spawning Command Shell
description: Detects the VeloCloud Orchestrator (VCO) Java/Tomcat service process
  spawning a shell interpreter. VCO is normally a self-contained Java/Tomcat web application
  and should not launch shells during normal operation; this pattern is consistent
  with exploitation of the pre-auth RCE (CVE-2026-16812) reaching privileged internal
  functionality and executing arbitrary commands.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - java
    - tomcat
    ParentCommandLine|contains:
    - velocloud
    - vco
    - orchestrator
    Image|endswith:
    - /bin/sh
    - /bin/bash
    - /bin/dash
    - /bin/ksh
  filter_known_admin_scripts:
    CommandLine|contains:
    - /opt/vmware/bin/backup.sh
    - /opt/vmware/bin/healthcheck.sh
  condition: selection and not filter_known_admin_scripts
falsepositives:
- Legitimate VCO maintenance or backup scripts invoked by the application through
  a wrapper shell
- Vendor-supplied diagnostic tooling that shells out from the Java process during
  support sessions
level: high
id: e1efc3be-c4dd-5b01-bfcc-09e4626cfac4
status: experimental
author: Vorant

Local Account Creation from VeloCloud Orchestrator Process Tree

ATT&CK T1190 · status experimental · needs linux process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects account creation or privilege-escalation commands (useradd, usermod, adduser to admin/sudo groups) launched from the VCO web application process tree, matching the reported post-exploitation capability to create accounts with full user rights. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Local Account Creation from VeloCloud Orchestrator Process Tree
description: Detects useradd/usermod/adduser or group-modification commands whose
  parent process chain originates from the VeloCloud Orchestrator (VCO) Java/Tomcat
  service. The report notes that exploitation of CVE-2026-16812 can be used to create
  accounts with full user rights; a management-plane web application spawning account-management
  utilities is anomalous and warrants investigation.
tags:
- attack.persistence
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - java
    - tomcat
    ParentCommandLine|contains:
    - velocloud
    - vco
    - orchestrator
    Image|endswith:
    - /useradd
    - /adduser
    - /usermod
    - /groupadd
    - /gpasswd
    CommandLine|contains:
    - sudo
    - wheel
    - admin
    - root
  condition: selection
falsepositives:
- Configuration management agents (Ansible, Puppet) that manage local accounts through
  the application's service account context
- Vendor-supported provisioning scripts executed during initial VCO setup
level: high
id: 10391474-f873-5408-9856-a3d19ed75322
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-velocloud-orchestrator-vco-on-prem-could-allow-for-remote-code-execution_2026-072

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs