Arista VeloCloud Orchestrator SQL injection flaw, CVSS 9.9, actively exploited
AIFlow_ML · x · 2026-10-23
Arista disclosed CVE-2026-114625, a critical SQL injection vulnerability in on-premises VeloCloud Orchestrator deployments (CVSS 9.9) that is being actively exploited. Any authenticated user—including the lowest built-in Enterprise Read Only role—can gain operator privileges and impersonate a local superuser operator.
- Affected: VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, 6.4.x before 6.4.2.12
- Fixed: 5.2.3.18, 6.1.3.10, 6.4.2.12; hosted and dedicated instances are already patched
More from Safety
- Ex-OpenAI futurist Joshua Achiam warns AI hacks could trigger internet lockdowns within months — jachiam0 · 2026-10-23
- Dario's predictions on track: Mythos 'security tsunami' warning and 6-12 month China catch-up window — rickasaurus · 2026-10-23
- Boundless offers abliterated DeepSeek V4.1 Flash for defensive security testing — MoonL88537 · 2026-10-23
- php2shell zero-day sparks AI cybersecurity debate as Anthropic uses Claude to harden 25 OSS codebases — connoraxiotes · 2026-10-23
- PHP hit by two unauthenticated RCE flaws; ProjectDiscovery launches free internet-wide alert service — cyb3rops · 2026-10-23
- Bindu Reddy mocks AI security panic: world didn't end, but Anthropic says it'll get 'a lot worse' — bindureddy · 2026-10-23