VeloCloud Orchestrator On-Prem vulnerabilities

3 known vulnerabilities in VeloCloud Orchestrator On-Prem from Arista Networks. 3 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.5 High severity

  VeloCloud Orchestrator On-Prem: Server-Side Request Forgery

  CVE-2026-17192Jul 27, 2026Arista Networks

  A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standar

• 9.1 Critical severity

  VeloCloud Orchestrator On-Prem: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-17191Jul 27, 2026Arista Networks

  An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlyi

• 10.0 Critical severity

  Arista VeloCloud Orchestrator On-Prem OS Command Injection Exploited

  CVE-2026-16812Jul 27, 2026Arista NetworksEPSS 1.76%

  VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability