Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-16812.
Upgrade to ProDetect Arista VeloCloud Orchestrator On-Prem OS Command Injection (CVE-2026-16812) in Microsoft Sentinel
Detects exploitation attempts and post-exploitation indicators of CVE-2026-16812, an OS command injection vulnerability (CWE-78) in Arista VeloCloud Orchestrator On-Prem, actively exploited in the wild and listed on CISA KEV. Attackers send crafted HTTP requests to the Orchestrator management application that result in arbitrary OS command execution on the underlying host, typically leading to shell spawning, reverse shell callbacks, credential harvesting, or webshell deployment.
MITRE ATT&CK
KQL Detection Query
let SuspiciousTokens = dynamic(['; ','&&','|','$(','`','wget ','curl ','/bin/sh','/bin/bash','base64 -d','python -c','nc -e','chmod +x']);
union isfuzzy=true
(CommonSecurityLog
| where DeviceVendor has 'Arista' or DeviceProduct has 'VeloCloud'
| where RequestURL has_any ('/portal', '/vco', '/velocloud', '/api')
| extend DecodedUrl = url_decode(RequestURL)
| where DecodedUrl has_any (SuspiciousTokens)),
(VMConnection
| where ProcessName has_any ('sh','bash','python','curl','wget','nc')
| where ParentProcessName has_any ('java','node','tomcat','httpd','nginx'))
| project TimeGenerated, DeviceVendor, SourceIP, DestinationIP, RequestURL, ProcessName, ParentProcessName
| sort by TimeGenerated descDetects HTTP requests to Arista VeloCloud Orchestrator management endpoints containing shell metacharacters or command-injection payload tokens, and correlates with unexpected child processes spawned from the Orchestrator's web application service (Java/Tomcat).
Data Sources
Required Tables
False Positives & Tuning
- Legitimate administrative scripts uploading configuration via automation using pipe or ampersand characters in benign contexts
- Vulnerability scanners intentionally sending injection test payloads without malicious follow-up
- Third-party network monitoring appliances proxying requests through the same reverse proxy path patterns
Other platforms for CVE-2026-16812
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate command injection payload via crafted HTTP request
Expected signal: Web/proxy access log entry showing the crafted URI with embedded semicolon and 'id' command token.
- Test 2Spawn shell process from simulated web application parent
Expected signal: Process creation event showing 'sh' or 'bash' with parent process name resembling 'java'.
- Test 3Simulate outbound tool download via curl/wget
Expected signal: Process execution log for curl/wget plus outbound network connection to the lab test server.
- Test 4Drop and remove a test webshell-like file
Expected signal: File creation and deletion event under the simulated web application directory captured by EDR/FIM.
References (4)
- https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-16812
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-16812 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month