Research · Jul 27, 2026 · ZeroDay Catalog
Critical OS Command Injection Vulnerability in Arista VeloCloud Orchestrator
A significant OS command injection vulnerability has been identified in the Arista VeloCloud Orchestrator, potentially allowing remote attackers to exploit internal functionalities.
What changed
A serious OS command injection vulnerability has been discovered in the Arista VeloCloud Orchestrator (VCO) On-Prem version. This flaw could enable remote attackers to access privileged internal functionalities, posing a risk to the orchestrator's host system.
The vulnerability threatens the confidentiality, integrity, and availability of both the orchestrator and the data it manages. It is critical to note that this functionality was designed for internal use and should not be accessible remotely.
Who is affected
The vulnerability impacts users of the Arista VeloCloud Orchestrator, specifically those utilizing the On-Prem version.
Both the Hosted and Dedicated versions of VCO have been patched prior to this disclosure.
- Arista Networks - Vendor responsible for VeloCloud Orchestrator.
- Organizations using the On-Prem version of VCO.
- IT departments managing network orchestration tools.
- Any entity relying on VCO for data management and orchestration.
What to do
Immediate action is required to mitigate the risks associated with this vulnerability. Users of the affected VCO version should ensure they are running the latest patched version.
It is advisable to review security configurations and restrict access to the orchestrator to prevent unauthorized exploitation.
- Update to the latest version of Arista VeloCloud Orchestrator.
- Implement strict access controls to the orchestrator.
- Monitor network traffic for any signs of exploitation attempts.
- Stay informed on further updates from Arista regarding this vulnerability.