CVE-2026-114625(arista / velocloud_orchestrator)

🚨 THE LAST 24 HOURS IN CYBER: 10 STORIES DEFENDERS SHOULD KNOW 🔴 Arista VeloCloud VCO zero-day exploited (CVE-2026-114625) 🔴 GitLab CVSS 10.0 unauthenticated RCE (CVE-2026-110264) 🔴 PHP2Shell: public PoC + attempts seen before disclosure 🎮 Capcom ID: 11.7M records exposed 🏥 Quest Diagnostics lab-portal unauthorized access 📦 LiteLLM malicious release via compromised accounts ☁️ Railway customer env vars possibly accessed 🔐 eMudhra exits the global SSL/TLS business 💀 Everest countdown on alleged PwC leak (claim) 📚 Comic Cmoa leak update: up to ~4.2M log records ✅ Patch edge & dev infra, rotate secrets, audit release pipelines. #CyberSecurity #ThreatIntel #ZeroDay #DataBreach

🚨 ARISTA VELOCLOUD ORCHESTRATOR ZERO-DAY ACTIVELY EXPLOITED (CVE-2026-114625) Arista published Security Advisory 0199 on Oct 22, 2026 for an actively exploited flaw in on-prem VeloCloud Orchestrator (VCO), the SD-WAN management portal. What's reported: • CVE-2026-114625: SQL injection, CVSS 3.1 score 9.9 (critical) • Any authenticated user, down to the lowest Enterprise Read Only tenant role, can gain operator privileges as a local "superuser operator" • Exposed by default; no configuration prevents it • Arista detected the flaw and says it is known to be actively exploited • Hosted and Dedicated VCO already patched; on-prem fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12 • Attack IPs observed: 74.82.197.86 and 38.54.50.151 ⚠️ Analyst Note: This is Arista's fourth exploited VCO/EOS zero-day this year. A single stolen read-only tenant login is enough, so on-prem operators should patch now, restrict the VCO web UI to admin networks, and hunt logs for the listed IPs. Preserve logs before remediation if compromise is suspected. Source: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 #DDW #DarkWeb #Arista #VeloCloud #ZeroDay #CVE #SDWAN #PatchNow #CyberSecurity

AristaのVeloCloud Orchestratorに重大脆弱性「CVE-2026-114625」、サイバー攻撃で悪用を確認　CVSS 9.9、低権限から特権取得の恐れ https://rocket-boys.co.jp/security-measures-lab/arista_velocloud_cve_2026_114625_active_exploitation_20261023/ #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース

🚨 Arista VeloCloud Orchestrator CVE-2026-114625: CVSS 9.9, known to be actively exploited, per Arista. Any logged-in user, even with the Enterprise Read Only role, can gain operator rights and act as the local superuser operator. Affects VCO On-Prem only. Hosted and Dedicated instances are already patched. Fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12. VulnTracker recommends updating now, restricting VCO web access to admin networks and reviewing logs for signs of compromise. Details: http://vulntracker.io/cves/CVE-2026-114625 #Arista #VeloCloud #CVE #InfoSec

AristaのVeloCloud Orchestratorに重大脆弱性「CVE-2026-114625」、サイバー攻撃で悪用を確認　CVSS 9.9、低権限から特権取得の恐れ https://rocket-boys.co.jp/security-measures-lab/arista_velocloud_cve_2026_114625_active_exploitation_20261023/

Arista patched an exploited zero-day in VeloCloud Orchestrator On-Prem. CVE-2026-114625 is an SQL injection vulnerability rated CVSS 9.9. Internet-facing management platforms remain high-value targets. https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199

VeloCloud Orchestrator, exploited again. Third time since July. CVE-2026-114625 (CVSS 9.9) is SQLi that turns any VCO login, even Enterprise Read Only, into superuser operator. MSPs hand those logins to customers and contractors. Fixed: 5.2.3.18 / 6.1.3.10 / 6.4.2.12 https://t.co/QksfEDcSmB

Arista patched CVE-2026-114625, a VeloCloud Orchestrator flaw under active exploitation. On-prem admins: patch now and check for compromise. #Cybersecurity #Arista #InfoSec https://cyberworldops.eu/en/arista-fixes-velocloud-orchestrator-flaw-under-active-exploitation-cve

Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months Arista has patched CVE-2026-114625, a critical SQL injection flaw in VeloCloud Orchestrator exploited as a zero-day. https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/ https://t.co/aZg7EVfTu5

CVE-2026-114625 (CVSS 9.9) is actively exploited in on-prem VeloCloud Orchestrator. Enterprise Read Only access is enough to reach local superuser. → Attacks from 74.82.197[.]86, 38.54.50[.]151 → Upgrade to your branch’s fixed VCO release Affected versions, hunt guidance, and remediation steps: https://hubs.la/Q04C6xBC0 #VeloCloud #SDWAN

Arista $ANET says CVE-2026-114625 in on-premises VeloCloud Orchestrator is actively exploited. An authenticated user can gain operator privileges. Security updates are available. https://t.co/4NT4yPodvt

csirt_it: ‼️ #Exploited #AristaNetworks: rilevato sfruttamento attivo in rete della CVE-2026-114625 presente in #VCO Rischio: 🔴 Tipologia: 🔸 Privilege Escalation 🔸 Security Restrictions Bypass 🔸 Spoofing 🔗 https://www.acn.gov.it/portale/w/arista-networks-rilevato-sfruttamento-in-rete-della-cve-2026-114625 ⚠️ Importante m… https://t.co/yCkaWmObpQ

CVE-2026-114625 (CVSS 9.9) de VeloCloud se explota en producción: usuarios read-only escalan a operador total. Arista confirma ataques activos. https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html

🚨 Zero-day Arista VeloCloud (CVE-2026-114625, CVSS 9,9) activement exploitée ! Un compte en lecture seule peut obtenir les privilèges superadmin. 🔐 VCO on-prem : installez 5.2.3.18, 6.1.3.10 ou 6.4.2.12 et limitez les accès. #Cyber

CVE-2026-114625 https://t.co/tBPvr802Ak

Arista VeloCloud Orchestrator zero-day CVE-2026-114625 (CVSS 9.9) is exploited in the wild: SQL injection lets any logged-in user, even Enterprise Read Only, act as "superuser operator". Hosted VCO is patched; on-prem needs 5.2.3.18 / 6.1.3.10 / 6.4.2.12. #ZeroDay #SDWAN #CVE https://t.co/T7oUj6lJQm

🚨Critical - Arista VeloCloud Orchestrator Authenticated SQLi Privilege Escalation (CVE-2026-114625) Arista VeloCloud Orchestrator (VCO) on-prem is vulnerable to authenticated SQL injection that lets a low-priv user invoke privileged internal-only operator endpoints and masquerade as a local “superuser operator.” This enables operator-level actions on the VCO host and can compromise orchestrator CIA and managed data. 👉Affected: Arista VeloCloud Orchestrator (VCO) on-prem < 5.2.3.18, < 6.1.3.10, < 6.4.2.12 | Upgrade to 5.2.3.18 / 6.1.3.10 / 6.4.2.12

Arista says attackers are exploiting CVE-2026-114625, a critical SQL injection flaw in VeloCloud Orchestrator that lets a logged-in user gain operator privileges. Fixes are available for on-premises releases; hosted and dedicated systems are patched. https://cyber.hendryadrian.com/article/7531/arista-patches-actively-exploited-velocloud-orchestrator-sql-injection-flaw

CVE-2026-114625 (CVSS 9.9): actively exploited flaw in on-prem VeloCloud Orchestrator lets any authenticated user, even read-only, gain superuser operator access. Affects 5.2 before 5.2.3.18, 6.1 before 6.1.3.10 and 6.4 before 6.4.2.12. Upgrade now. Source: Arista

Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day (CVE-2026-114625) Arista Networks has issued security updates for an actively exploited SQL injection zero-day in VeloCloud… Full write-up → link in bio #cybersecurity #infosec #VulnerabilityDisclosure #arista https://t.co/U3f5JrOlgF