[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

2 clusters · 11 sources · 3 days · First seen · Last updated

Arista VeloCloud Orchestrator vulnerability exploitation

Overview

Arista Networks identified and released patches for a critical zero-day SQL injection vulnerability in its VeloCloud Orchestrator (VCO), tracked as CVE-2026-114625. The flaw, which carries a CVSS score of 9.9, allows an attacker with minimal ‘Enterprise Read Only’ access to escalate privileges to superuser or operator status. This elevation of privilege enables attackers to modify the orchestrator, access managed data, and potentially impact the host system.

Arista confirmed the vulnerability was being used in active attacks. Following these reports, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. While hosted and dedicated deployments were patched, on-premises operators were advised to update to specific fixed builds to mitigate the risk.

Entities

Arista Networks · CISA · Nextcloud · Broadcom · VeloCloud Orchestrator

Timeline

  1. [TECHNOLOGY] 5 sources
    CISA flags critical vulnerabilities in Collabora Online and Arista VeloCloud

    CISA has identified two actively exploited critical vulnerabilities in Collabora Online and Arista VeloCloud, involving remote code execution and privilege escalation risks.

  2. [TECHNOLOGY] 7 sources
    Arista Networks patches exploited VeloCloud zero-day vulnerability

    Arista Networks has patched a critical 9.9 CVSS SQL injection zero-day in VeloCloud Orchestrator that allows read-only users to gain superuser privileges. The flaw is currently being exploited.

Sources

apdt.com · cryptopolitan.com · cybernoz.com · dev.to · drweb.de · esecurityplanet.com · infoguerra.com.br · inteco.es · moncloa.com · securityaffairs.com · thehackernews.com