Velocloud Orchestrator

Arista patches actively exploited VeloCloud Orchestrator SQL injection flaw

Arista Networks has issued security updates for a critical zero-day, CVE-2026-114625, affecting on-premises VeloCloud Orchestrator deployments. The flaw lets authenticated users with basic privileges exploit a low-complexity SQL injection to escalate to 'superuser operator' access without user interaction, and Arista says it has already patched its own hosted VCO instances on versions 5.2.3.18+, 6.1.3.10+, and 6.4.2.12+.

bleepingcomputer.com · 2026-10-22

Arista fixes actively exploited VeloCloud Orchestrator zero-day, CISA sets Sept 25 deadline

Arista Networks has issued patches for CVE-2026-93952, a maximum-severity flaw in on-premises deployments of VeloCloud Orchestrator, the centralized management platform for VeloCloud SD-WANs. The bug, an improper input validation issue affecting setups using certificate-based authentication between edge devices and the orchestrator, lets remote attackers gain privileged internal access without credentials or user interaction, and Arista says it is already being exploited in the wild.

bleepingcomputer.com · 2026-09-23