Report
Arista patches actively exploited VeloCloud Orchestrator zero-day
BleepingComputer reports the SQL injection flaw could let authenticated users gain operator privileges on affected on-premises deployments.
TLDR
BleepingComputer reports Arista patched CVE-2026-114625, an actively exploited SQL injection flaw in on-premises VeloCloud Orchestrator. Arista says an authenticated user can gain operator privileges on an affected system. SecurityWeek reports this is the third exploited VeloCloud Orchestrator zero-day patched in four months. It says Arista has already patched hosted deployments and urged on-premises users to update.
Combined views
6.9K
2 Sources, first seen ago