CVE-2026-16812 is an OS command injection vulnerability in Arista VeloCloud Orchestrator On-Prem. A remote attacker can exploit this flaw to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages. The vulnerability has been flagged by CISA under BOD 26-04, which prioritizes security updates based on risk. An official security advisory has been published by Arista. Organizations using the affected product are urged to apply patches promptly. The vulnerability is tracked in NVD as well.