CVE-2026-16812

Name of the Vulnerable Software and Affected Versions VeloCloud Orchestrator (VCO) on-prem (affected versions not specified)

Description A security issue in the on-premises version of the orchestrator allows a remote attacker to access privileged internal functionality, which may lead to OS command injection. This functionality was intended for internal use only and should not be remotely accessible. Successful exploitation can compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages. This issue is known to be actively exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.