63 matches found
Arista VeloCloud Orchestrator SQL Injection Vulnerability
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data...
CVE-2026-114625
VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...
CVE-2026-114625 Security Advisory 0199
VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...
CVE-2026-114625 Security Advisory 0199
VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...
EUVD-2026-108511
VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...
CVE-2026-114625
Arista VeloCloud Orchestrator (VCO) on-prem is vulnerable to a SQL injection flaw (CWE-89) that allows an authenticated user with the lowest Enterprise Read Only role to gain operator privileges . This allows the attacker to masquerade as a local superuser operator , accessing internal-only funct...
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator VCO, the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer accoun...
Security Advisory 0199
Security Advisory 0199 . CSAF PDF Date: October 22, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 22, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-114625 CVSSv3.1 Base Score: 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSSv4.0 Base Score: 9.4...
PT-2026-121506
Name of the Vulnerable Software and Affected Versions Arista VeloCloud Orchestrator versions prior to 5.2.3.18 Arista VeloCloud Orchestrator versions prior to 6.1.3.10 Arista VeloCloud Orchestrator versions prior to 6.4.2.12 Description Arista VeloCloud Orchestrator VCO on-premises deployments...
VulnCheck KEV: CVE-2026-114625
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data...
Arista VeloCloud Orchestrator Auth Bypass (CVE-2026-93952)
Targets CVE-2026-93952 in on-prem VeloCloud Orchestrator VCO: when certificate-based Edge authentication is enabled, forged/absent cert checks may allow unauthenticated access to privileged portal and REST APIs. Probes internal API routes after portal fingerprinting. !/usr/bin/env python3 --...
Arista VeloCloud CVE-2026-93952 Detect
Detects on-prem VeloCloud Orchestrator VCO exposure to CVE-2026-93952 before fixed releases 5.2.3.16 / 6.4.2.8. The flaw allows unauthenticated access to privileged internal functionality when certificate-based Edge authentication is enabled. Fingerprints the VCO portal and parses version markers...
VeloCloud Orchestrator Code Execution
The vulnerability of the locally deployed version of the orchestrator VeloCloud Orchestrator VCO on the VMware SD-WAN by VeloCloud On-Prem platform is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute...
Vulnerability handling in VeloCloud Orchestrator (VCO) on-premises
VeloCloud has identified a vulnerability in VeloCloud Orchestrator VCO on-premises. This vulnerability allows external attackers to access privileged internal functions, which can compromise privacy, integrity, and availability. The vulnerability is actively exploited and has already been exploit...
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator VCO, the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22. The flaw, tracked as CVE-2026-93952 , may allow a remote attacker with no login access to privilege internal functions and...
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-85102 Check Point Multiple Products Improper Certificate Validation Vulnerability CVE-2026-93616 Check Point Multiple Products Path Traversal Vulnerabilit...
CVE-2026-93952
VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...
CVE-2026-93952 Security Advisory 0183
VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...
EUVD-2026-84296
VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...
CVE-2026-93952
The VeloCloud Orchestrator (VCO) on-prem platform is vulnerable to an improper input validation flaw (CWE-20 ). A remote attacker without login access can exploit this to access privileged internal functions, potentially compromising the confidentiality, integrity, and availability of the orchest...