Uzha
Sign in
← Today's brief

Security · Updated 23 Oct, 12:35 am IST

Arista patches actively exploited VeloCloud Orchestrator SQL injection zero-day

Image: BleepingComputer

Why it matters for readers: This shows how a single web vulnerability in network management software can be used to gain wide control.

  • The flaw is a SQL injection in VeloCloud Orchestrator that allows authenticated users with basic privileges to gain operator/superuser access.12
  • The vulnerability is tracked as CVE-2026-114625 and has been rated critical (9.9 CVSS in reporting).2
  • Arista said hosted and dedicated orchestrators have already been patched, and provided fixed on‑prem releases (VCO 5.2.3.18, 6.1.3.10, 6.4.2.12).12
  • Until patches are deployed, Arista advised monitoring for malicious IPs and restricting access to the VCO web interface.1
SaveAsk about this story
Report a mistake in this summary

Get a brief like this every morning

Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.

Get started

How this story developed

  1. 22 Oct, 10:48 pm · BleepingComputer

    Arista patches new VeloCloud Orchestrator zero-day exploited in attacks

  2. 23 Oct, 12:35 am · The Hacker News

    Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks