Arista · VeloCloud Orchestrator
Updated October 24, 2026
The on‑prem VeloCloud Orchestrator contains an unauthenticated SQL injection that grants attackers privileged access to internal functions and the host system. Exploitation compromises confidentiality, integrity, and availability of the orchestration platform and all managed network data.
An attacker could steal or modify routing policies, inject malicious configurations, or disrupt WAN services, potentially leading to network outages or data exfiltration.
Apply the latest security patch released by Arista immediately and restrict VCO management interfaces to trusted networks; monitor database logs for suspicious queries.
More active vulnerabilities