CVE-2026-16812 CrowdStrike LogScale · LogScale

Detect Arista VeloCloud Orchestrator On-Prem OS Command Injection (CVE-2026-16812) in CrowdStrike LogScale

Detects exploitation attempts and post-exploitation indicators of CVE-2026-16812, an OS command injection vulnerability (CWE-78) in Arista VeloCloud Orchestrator On-Prem, actively exploited in the wild and listed on CISA KEV. Attackers send crafted HTTP requests to the Orchestrator management application that result in arbitrary OS command execution on the underlying host, typically leading to shell spawning, reverse shell callbacks, credential harvesting, or webshell deployment.

MITRE ATT&CK

Tactic
Initial Access Execution Lateral Movement

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=ProcessRollup2
| ParentBaseFileName in ("java.exe", "java", "tomcat*", "httpd", "nginx")
| in(field=FileName, values=["sh", "bash", "curl", "wget", "python*", "nc", "ncat", "perl"])
| join(query={#event_simpleName=NetworkConnectIP4 | RemotePort=443 OR RemotePort=80}, field=aid, key=aid, mode=inner)
| table([ComputerName, ParentBaseFileName, FileName, CommandLine, RemoteAddressIP4, RemotePort, timestamp])
critical severity medium confidence

Detects suspicious shell or interpreter process execution spawned from the Arista VeloCloud Orchestrator web application process (Java/Tomcat) correlated with outbound network connections, consistent with post-exploitation of CVE-2026-16812.

Data Sources

ProcessRollup2NetworkConnectIP4

Required Tables

ProcessRollup2NetworkConnectIP4

False Positives & Tuning

  • Legitimate administrative scripts executed manually by operators via the application host
  • Configuration management agents installed directly on the Orchestrator appliance
  • Scheduled maintenance tasks that spawn shell utilities from the web service account

Other platforms for CVE-2026-16812

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate command injection payload via crafted HTTP request

    Expected signal: Web/proxy access log entry showing the crafted URI with embedded semicolon and 'id' command token.

  2. Test 2Spawn shell process from simulated web application parent

    Expected signal: Process creation event showing 'sh' or 'bash' with parent process name resembling 'java'.

  3. Test 3Simulate outbound tool download via curl/wget

    Expected signal: Process execution log for curl/wget plus outbound network connection to the lab test server.

  4. Test 4Drop and remove a test webshell-like file

    Expected signal: File creation and deletion event under the simulated web application directory captured by EDR/FIM.

Last updated: 2026-07-28 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the affected VeloCloud Orchestrator On-Prem instance's version against Arista's advisory 24364-security-advisory-0144 and determine if it is internet-exposed.
  2. Review web/proxy access logs for requests to Orchestrator management paths (/portal, /vco, /velocloud, /api) containing shell metacharacters or command tokens in the timeframe surrounding the alert.
  3. Inspect the Orchestrator application server's process tree for unexpected child processes (sh, bash, curl, wget, python, nc) spawned from the Java/Tomcat web service.
  4. Check for newly created or modified files under the Orchestrator web application directories that may indicate a webshell was dropped.

Containment

  1. If internet-exposed and unpatched, immediately restrict inbound access to the Orchestrator management interface via firewall/ACL to trusted management IPs only, or take it offline.
  2. Isolate the affected Orchestrator host from the network (retaining forensic access) if active command execution or outbound C2 traffic is confirmed.
  3. Rotate all credentials and API tokens stored on or used to manage the Orchestrator instance, including edge device enrollment tokens.

Evidence Collection

  1. Preserve web server/proxy access and error logs, Orchestrator application logs, and system audit logs (auditd/EDR) covering the suspected exploitation window.
  2. Capture a forensic image or memory snapshot of the Orchestrator host prior to remediation if compromise is confirmed or suspected.
  3. Collect any dropped files, webshells, or scheduled tasks/cron entries found on the host for malware analysis.

Escalation Criteria

  • !Escalate to incident response if command execution is confirmed on the Orchestrator host, given its central management role over SD-WAN edge devices.
  • !Escalate immediately if evidence shows lateral movement from the Orchestrator into managed edge devices or the broader corporate network.
  • !Escalate if the instance is confirmed internet-facing and unpatched, given this CVE is listed on CISA KEV and subject to federal remediation deadlines under BOD 26-04.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Web/proxy access logs showing requests to /portal, /vco, /velocloud, or /api paths with embedded shell metacharacters
  • >Process execution logs (auditd, EDR) showing shell interpreters spawned as children of the Orchestrator's Java/Tomcat process
  • >Newly created files, cron jobs, or systemd units on the Orchestrator host indicating persistence

Tuning Guidance

Baseline legitimate administrative and automation traffic to the Orchestrator's management API paths before enabling this rule in blocking/high-severity alerting mode, since some configuration workflows may legitimately include special characters in query strings. Narrow matching to combinations of injection tokens plus known malicious command substrings (wget/curl/base64 -d/nc -e) rather than single metacharacters alone to reduce false positives, and prioritize the process-correlation detections (EQL/CQL) over URL-pattern-only detections for higher-confidence alerting.

Hunting Queries

Broader retrospective hunt across the last 30-90 days for any historical requests to the Orchestrator matching command injection indicators, to identify prior undetected exploitation attempts.

Hunting — KQL
kql 
CommonSecurityLog
| where DeviceVendor has 'Arista' or DeviceProduct has 'VeloCloud'
| where RequestURL has_any ('wget','curl','base64','/bin/sh')
| summarize count() by SourceIP, RequestURL, bin(TimeGenerated, 1h)
Hunting — SPL
spl 
index=network sourcetype=arista_velocloud OR sourcetype=proxy
| search uri_path="*wget*" OR uri_path="*curl*" OR uri_path="*base64*" OR uri_path="*/bin/sh*"
| stats count by src_ip, uri_path, _time

Atomic Red Team Tests

Test 1 Simulate command injection payload via crafted HTTP request
linux

Sends a crafted HTTP GET request containing shell metacharacters to a lab Orchestrator management endpoint to validate detection of injection attempts.

Command

bash 
curl -s -k 'https://lab-orchestrator.local/portal/rest/test?cmd=;id' -H 'User-Agent: atomic-test'

Cleanup

bash 
No persistent changes made; clear test entries from proxy/access logs if log retention testing requires a clean baseline.

Expected Telemetry

Web/proxy access log entry showing the crafted URI with embedded semicolon and 'id' command token.

Expected Detection

KQL/SPL/Chronicle rules alert on the request URI containing shell metacharacters directed at the Orchestrator management path.

Test 2 Spawn shell process from simulated web application parent
linux

Simulates a shell process being spawned as a child of a Java/Tomcat-like parent process to emulate post-exploitation command execution on the Orchestrator host.

Command

bash 
bash -c 'exec -a java bash -c "/bin/sh -c id"'

Cleanup

bash 
No files or persistence created; terminate any residual test shell processes.

Expected Telemetry

Process creation event showing 'sh' or 'bash' with parent process name resembling 'java'.

Expected Detection

Elastic EQL sequence rule and CrowdStrike CQL query alert on shell interpreter spawned from a Java-named parent process.

Test 3 Simulate outbound tool download via curl/wget
linux

Executes a curl/wget download to a benign lab-controlled endpoint to emulate post-exploitation ingress tool transfer behavior following exploitation.

Command

bash 
curl -s -o /tmp/atomic_test_payload http://lab-test-server.local/benign_payload.txt && rm -f /tmp/atomic_test_payload

Cleanup

bash 
Command self-removes the downloaded test file; verify /tmp/atomic_test_payload no longer exists.

Expected Telemetry

Process execution log for curl/wget plus outbound network connection to the lab test server.

Expected Detection

CrowdStrike CQL join query and Elastic EQL correlate the process execution with the outbound network connection.

Test 4 Drop and remove a test webshell-like file
linux

Creates and immediately removes a test file in a web-accessible directory on a lab Orchestrator instance to validate file-creation monitoring for webshell persistence.

Command

bash 
touch /tmp/lab_webapp_root/test_webshell.jsp && sleep 2 && rm -f /tmp/lab_webapp_root/test_webshell.jsp

Cleanup

bash 
File is removed by the command itself; confirm no residual file remains in the test web application directory.

Expected Telemetry

File creation and deletion event under the simulated web application directory captured by EDR/FIM.

Expected Detection

SIEM file integrity monitoring alert or EDR file-creation rule flags the new file in the web application root as a potential webshell.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.004Unix ShellT1105Ingress Tool Transfer

Same Tactic: Initial Access

Popular Detections