https://pwn.watch/t/velocloud Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 20:14:54 GMT https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625 https://pwn.watch/i/arista-velocloud-orchestrator-cve-2026-114625 Thu, 22 Oct 2026 20:14:54 GMT critical <p>Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.</p> <p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 5.2.3.18, 6.1.3.10, 6.4.2.12</p> <p><strong>Latest updates:</strong></p><ul><li>2026-10-22: Arista disclosed CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator, with fixes in 5.2.3.18, 6.1.3.10 and 6.4.2.12. Hosted VCO is already patched. Arista advised restricting the VCO web interface to admin networks, blocking 74.82.197.86 and 38.54.50.151, and preserving logs before remediating if compromise is suspected. (<a href="https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2026-114625</p>