{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:10:46.198Z",
  "tag": {
    "id": "arista",
    "label": "Arista",
    "isStack": false,
    "url": "https://pwn.watch/t/arista",
    "feed": "https://pwn.watch/t/arista/feed.xml"
  },
  "counts": {
    "incidents": 3,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 3
  },
  "incidents": [
    {
      "slug": "arista-velocloud-orchestrator-cve-2026-114625",
      "title": "Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks",
      "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625",
      "json": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Arista VeloCloud Orchestrator (VCO) On-Prem",
      "tags": [
        "arista",
        "velocloud",
        "sd-wan",
        "sql-injection",
        "zero-day",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2026-114625"
      ],
      "affectedVersions": [
        "VCO 5.2.x before 5.2.3.18",
        "VCO 6.1.x before 6.1.3.10",
        "VCO 6.4.x before 6.4.2.12"
      ],
      "fixedVersions": [
        "5.2.3.18",
        "6.1.3.10",
        "6.4.2.12"
      ],
      "startedAt": "2026-10-22",
      "closedAt": null,
      "updatedAt": "2026-10-22T20:32:13+02:00",
      "summary": "Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.",
      "xPost": {
        "id": "2113331616257077699",
        "postedAt": "2026-10-22T18:08:16.065Z",
        "url": "https://x.com/pwnwatch_app/status/2113331616257077699"
      }
    },
    {
      "slug": "arista-velocloud-orchestrator-cve-2026-16812",
      "title": "Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability",
      "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-16812",
      "json": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-16812.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Arista VeloCloud Orchestrator",
      "tags": [
        "arista",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-16812"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-07-27",
      "closedAt": "2026-07-27",
      "updatedAt": "2026-07-27",
      "summary": "Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Added to CISA KEV on 2026-07-27.",
      "xPost": null
    },
    {
      "slug": "arista-extensible-operating-system-cve-2026-7473",
      "title": "Arista Extensible Operating System: Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability",
      "url": "https://pwn.watch/i/arista-extensible-operating-system-cve-2026-7473",
      "json": "https://pwn.watch/i/arista-extensible-operating-system-cve-2026-7473.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Arista Extensible Operating System",
      "tags": [
        "arista",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-7473"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-06-09",
      "closedAt": "2026-06-09",
      "updatedAt": "2026-06-09",
      "summary": "Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. Added to CISA KEV on 2026-06-09.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Dark Web Informer",
      "handle": "DarkWebInformer",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2109088203504287744/BJcETLaO_bigger.jpg",
      "text": "🚨 Critical Arista VeloCloud Orchestrator SQL injection flaw actively exploited\n\nArista has disclosed CVE-2026-114625, a critical vulnerability affecting on-premises VeloCloud Orchestrator deployments.\n⠀\nThe SQL injection flaw allows any authenticated user, including someone https://t.co/YmvPfvAwhb",
      "date": "2026-10-22T15:33:25.000Z",
      "url": "https://x.com/DarkWebInformer/status/2113292650828726321",
      "media": [],
      "incident": "arista-velocloud-orchestrator-cve-2026-114625"
    }
  ],
  "changes": [
    {
      "incident": "arista-velocloud-orchestrator-cve-2026-114625",
      "incidentTitle": "Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Arista disclosed CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator, with fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO is already patched. Arista advised restricting the VCO web interface to admin networks, blocking 74.82.197.86 and 38.54.50.151, and preserving logs before remediating if compromise is suspected.",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/",
      "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625"
    },
    {
      "incident": "arista-velocloud-orchestrator-cve-2026-16812",
      "incidentTitle": "Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-07-27",
      "title": "CISA added CVE-2026-16812 to the KEV catalog (due 2026-07-30).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-16812"
    },
    {
      "incident": "arista-extensible-operating-system-cve-2026-7473",
      "incidentTitle": "Arista Extensible Operating System: Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-06-09",
      "title": "CISA added CVE-2026-7473 to the KEV catalog (due 2026-06-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/arista-extensible-operating-system-cve-2026-7473"
    }
  ]
}