---
title: Hackers Are Actively Exploiting a Critical VeloCloud Orchestrator Vulnerability
description: Urgent patch needed for critical Arista VeloCloud flaw (CVE-2026-16812) actively exploited. Secure your systems now. Block IPs and rotate credentials.
canonical_url: https://codekeeper.co/ticker/critical-velocloud-flaw-cve-2026-16812
---

# Hackers Are Actively Exploiting a Critical VeloCloud Orchestrator Vulnerability

Urgent patch needed for critical Arista VeloCloud flaw (CVE-2026-16812) actively exploited. Secure your systems now. Block IPs and rotate credentials.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 4, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-velocloud-flaw-cve-2026-16812%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-velocloud-flaw-cve-2026-16812%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-velocloud-flaw-cve-2026-16812%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-velocloud-flaw-cve-2026-16812%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-velocloud-flaw-cve-2026-16812%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-velocloud-flaw-cve-2026-16812%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A maximum-severity command injection flaw (CVE-2026-16812, CVSS 10.0) in on-premises Arista VeloCloud Orchestrator — formerly VeloCloud Orchestrator by Broadcom — is being actively exploited in the wild, and was exploited as a zero-day. Attackers need no credentials, just network access to the VCO web interface, to take control of the orchestrator and the SD-WAN fabric it manages. Affected versions span VCO 5.2.x, 6.1.x, 6.4.x and 7.0.x. Fixes are available in 5.2.3.14, 6.1.3.4, 6.4.2.4 and 7.0.0.1. Hosted and Dedicated VCO instances were already patched by Arista. Three attacker IPs have been identified: 8.19.75.217, 206.72.242.124, and 206.72.242.162. Admins should patch immediately, block those addresses and restrict web interface access. Arista also requires rotating credentials and validating device state after remediation — not only where compromise is suspected. Source: [Cybersecurity News](https://cybersecuritynews.com/velocloud-command-injection-exploit/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-velocloud-flaw-cve-2026-16812%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-velocloud-flaw-cve-2026-16812%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-velocloud-flaw-cve-2026-16812%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-velocloud-flaw-cve-2026-16812%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-velocloud-flaw-cve-2026-16812%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcritical-velocloud-flaw-cve-2026-16812%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[AWS Links npm Supply Chain Attacks to North Korean Hackers Aug 11, 2026](https://codekeeper.co/ticker/north-korean-group-targets-npm-libraries)

[Vulnerabilities Critical GitLab Vulnerability Under Active Attack — Patch Now Aug 24, 2026](https://codekeeper.co/ticker/gitlab-vulnerability-cve-2026-19478-patch-now)

[Data breaches Minnesota Supreme Court Hit by Third-Party Data Breach Sep 4, 2026](https://codekeeper.co/ticker/minnesota-courts-data-breach-thomson-reuters)

[Over 100 NPM and PyPI Packages Infected in Escalating Shai-Hulud Supply Chain Attacks Aug 12, 2026](https://codekeeper.co/ticker/shai-hulud-worm-infects-npm-pypi-packages)