CVE-2026-16812
Severity CVSS v4.0:
CRITICAL
Type:
CWE-78
OS Command Injections
Publication date:
27/07/2026
Last modified:
27/07/2026
Description
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.<br />
<br />
<br />
<br />
<br />
This functionality was intended to be for internal use only and is not intended to be remotely accessible.<br />
<br />
<br />
<br />
<br />
Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out.<br />
<br />
<br />
<br />
<br />
This issue was discovered externally and is known to be actively exploited.
Impact
Base Score 4.0
10.00
Severity 4.0
CRITICAL
Base Score 3.x
10.00
Severity 3.x
CRITICAL