{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:58:23.236Z",
  "tag": {
    "id": "velocloud",
    "label": "VeloCloud",
    "isStack": false,
    "url": "https://pwn.watch/t/velocloud",
    "feed": "https://pwn.watch/t/velocloud/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "arista-velocloud-orchestrator-cve-2026-114625",
      "title": "Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks",
      "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625",
      "json": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Arista VeloCloud Orchestrator (VCO) On-Prem",
      "tags": [
        "arista",
        "velocloud",
        "sd-wan",
        "sql-injection",
        "zero-day",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2026-114625"
      ],
      "affectedVersions": [
        "VCO 5.2.x before 5.2.3.18",
        "VCO 6.1.x before 6.1.3.10",
        "VCO 6.4.x before 6.4.2.12"
      ],
      "fixedVersions": [
        "5.2.3.18",
        "6.1.3.10",
        "6.4.2.12"
      ],
      "startedAt": "2026-10-22",
      "closedAt": null,
      "updatedAt": "2026-10-22T21:32:20+02:00",
      "summary": "Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.",
      "xPost": {
        "id": "2113331616257077699",
        "postedAt": "2026-10-22T18:08:16.065Z",
        "url": "https://x.com/pwnwatch_app/status/2113331616257077699"
      }
    }
  ],
  "posts": [
    {
      "authorName": "The Hacker News",
      "handle": "TheHackersNews",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg",
      "text": "‼️ Critical VeloCloud SQL injection flaw exploited in the wild.\n\nTracked as CVE-2026-114625 (CVSS 9.9), the flaw lets even read-only users escalate to full operator privileges.\n\nArista confirms active attacks.\n\nWhat admins need to know ↓ https://t.co/NHJ4SMAP84",
      "date": "2026-10-22T19:06:41.000Z",
      "url": "https://x.com/TheHackersNews/status/2113346318953545907",
      "media": [],
      "incident": "arista-velocloud-orchestrator-cve-2026-114625"
    },
    {
      "authorName": "Dark Web Informer",
      "handle": "DarkWebInformer",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2109088203504287744/BJcETLaO_bigger.jpg",
      "text": "🚨 Critical Arista VeloCloud Orchestrator SQL injection flaw actively exploited\n\nArista has disclosed CVE-2026-114625, a critical vulnerability affecting on-premises VeloCloud Orchestrator deployments.\n⠀\nThe SQL injection flaw allows any authenticated user, including someone https://t.co/YmvPfvAwhb",
      "date": "2026-10-22T15:33:25.000Z",
      "url": "https://x.com/DarkWebInformer/status/2113292650828726321",
      "media": [],
      "incident": "arista-velocloud-orchestrator-cve-2026-114625"
    }
  ],
  "changes": [
    {
      "incident": "arista-velocloud-orchestrator-cve-2026-114625",
      "incidentTitle": "Arista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Arista disclosed CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator, with fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO is already patched. Arista advised restricting the VCO web interface to admin networks, blocking 74.82.197.86 and 38.54.50.151, and preserving logs before remediating if compromise is suspected.",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/",
      "url": "https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625"
    }
  ]
}