Arista VeloCloud Orchestrator On-Prem OS Command Injection (CVE-2026-16812)

let SuspiciousTokens = dynamic(['; ','&&','|','$(','`','wget ','curl ','/bin/sh','/bin/bash','base64 -d','python -c','nc -e','chmod +x']);
union isfuzzy=true
  (CommonSecurityLog
   | where DeviceVendor has 'Arista' or DeviceProduct has 'VeloCloud'
   | where RequestURL has_any ('/portal', '/vco', '/velocloud', '/api')
   | extend DecodedUrl = url_decode(RequestURL)
   | where DecodedUrl has_any (SuspiciousTokens)),
  (VMConnection
   | where ProcessName has_any ('sh','bash','python','curl','wget','nc')
   | where ParentProcessName has_any ('java','node','tomcat','httpd','nginx'))
| project TimeGenerated, DeviceVendor, SourceIP, DestinationIP, RequestURL, ProcessName, ParentProcessName
| sort by TimeGenerated desc

index=network sourcetype=arista_velocloud OR sourcetype=proxy
| eval decoded_uri=urldecode(uri_path)
| regex decoded_uri="(;|\||&&|\$\(|`|wget\s|curl\s|/bin/(sh|bash)|base64\s+-d|nc\s+-e)"
| where match(uri_path, "(?i)(/portal|/vco|/velocloud|/api)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, uri_path, http_method
| where count > 0
| sort - last_seen

sequence by host.ip with maxspan=5m
  [network where url.path : ("*/portal*", "*/vco*", "*/velocloud*", "*/api*") and
    (url.query : ("*;*", "*&&*", "*|*", "*$(*", "*`*", "*wget*", "*curl*", "*/bin/sh*", "*/bin/bash*"))]
  [process where event.type == "start" and
    process.parent.name : ("java", "tomcat*", "httpd", "nginx") and
    process.name : ("sh", "bash", "curl", "wget", "python*", "nc", "ncat", "perl")]

SELECT sourceip, destinationip, "URL", UTF8(payload) as decoded_payload, starttime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%VeloCloud%' OR LOGSOURCETYPENAME(devicetype) ILIKE '%Arista%'
AND ("URL" ILIKE '%/portal%' OR "URL" ILIKE '%/vco%' OR "URL" ILIKE '%/velocloud%' OR "URL" ILIKE '%/api%')
AND (UTF8(payload) ILIKE '%;%' OR UTF8(payload) ILIKE '%&&%' OR UTF8(payload) ILIKE '%$(%' OR UTF8(payload) ILIKE '%wget %' OR UTF8(payload) ILIKE '%curl %' OR UTF8(payload) ILIKE '%/bin/sh%' OR UTF8(payload) ILIKE '%/bin/bash%')
LAST 24 HOURS

_sourceCategory=*velocloud* OR _sourceCategory=*arista*
| parse regex "(?<uri_path>/(portal|vco|velocloud|api)\S*)"
| where uri_path matches "*"
| parse regex "(?<payload>[;&|`]|\$\(|wget\s|curl\s|/bin/sh|/bin/bash)" nodrop
| where !isNull(payload)
| count by uri_path, payload, sourceIP
| sort by _count

rule velocloud_orchestrator_cmd_injection_cve_2026_16812 {
  meta:
    author = "df00tech detection engineering"
    description = "Detects OS command injection attempts against Arista VeloCloud Orchestrator On-Prem (CVE-2026-16812)"
    severity = "critical"
  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.target.url = /.*(\/portal|\/vco|\/velocloud|\/api).*/ nocase
    $http.target.url = /.*(;|&&|\||\$\(|`|wget%20|curl%20|%2Fbin%2Fsh|%2Fbin%2Fbash).*/ nocase
  match:
    $http over 5m
  condition:
    $http
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName in ("java.exe", "java", "tomcat*", "httpd", "nginx")
| in(field=FileName, values=["sh", "bash", "curl", "wget", "python*", "nc", "ncat", "perl"])
| join(query={#event_simpleName=NetworkConnectIP4 | RemotePort=443 OR RemotePort=80}, field=aid, key=aid, mode=inner)
| table([ComputerName, ParentBaseFileName, FileName, CommandLine, RemoteAddressIP4, RemotePort, timestamp])