PT-2026-64991 · Vmware · Velocloud Orchestrator

CVE-2026-16812 · Published 2026-07-27 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VeloCloud Orchestrator (VCO) on-prem (affected versions not specified)

Description A security issue in the on-premises version of the orchestrator allows a remote attacker to access privileged internal functionality, which may lead to OS command injection. This functionality was intended for internal use only and should not be remotely accessible. Successful exploitation can compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages. This issue is known to be actively exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-16812

Affected Products

Velocloud Orchestrator

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-16812 · Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812 · Note
• https://arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144 · Security Note, Vendor Advisory