<![CDATA[🔴 Critical: Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks]]>Arista has disclosed a critical zero-day vulnerability in VeloCloud Orchestrator (VCO), the central management system used to administer VeloCloud SD-WAN networks. According to the company's advisory published on October 22, the SQL injection flaw is already being exploited in real-world attacks.

The most concerning aspect of this vulnerability is how little access an attacker needs to abuse it. Anyone who can authenticate to the orchestrator — including a user holding only a read-only customer account — can exploit the flaw to escalate their privileges to operator level, which is the highest tier of control over the system.

Key points to be aware of:

  • The vulnerability is a SQL injection issue in VeloCloud Orchestrator (VCO).
  • Exploitation requires only a valid login; a low-privileged read-only account is sufficient.
  • Successful exploitation grants operator privileges, the top level of control over the orchestrator.
  • The flaw is a zero-day and has been observed exploited in active attacks.
  • Arista published its advisory on October 22.

If your organization runs VeloCloud SD-WAN, review the advisory directly and apply any guidance or fixes Arista has issued. Given that a read-only account is enough to weaponize this flaw, auditing orchestrator accounts and their access levels should be a priority while remediation is underway.

Source: info@thehackernews.com (The Hacker News)

Does your organization run VeloCloud Orchestrator, and if so, how are you approaching mitigation?

]]>https://xploitlk.com/topic/759/critical-arista-warns-of-critical-velocloud-sql-injection-zero-day-exploited-in-attacksRSS for NodeTue, 27 Oct 2026 07:48:41 GMTFri, 23 Oct 2026 04:30:20 GMT60