#VeloCloud
All CosmicBytez Labs articles tagged #VeloCloud, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-114625: Arista VeloCloud Orchestrator On-Prem SQL Injection Exploited in the Wild
A CVSS 9.9 flaw in on-prem VeloCloud Orchestrator lets any authenticated user gain operator privileges. Arista confirms exploitation; CISA added it to KEV.
- News
Arista Urges Immediate Patching of Exploited VCO Zero-Day
Arista's VeloCloud Orchestrator has a critical zero-day (CVE-2026-93952, CVSS 10.0) under active attack; patch now or restrict web-interface access.
- News
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
Arista disclosed CVE-2026-93952, a CVSS 10.0 pre-auth privilege escalation in VeloCloud Orchestrator, already under active exploitation.
- Newsletter
Weekly Digest — Issue #36
Arista's VeloCloud takes a CVSS 10.0 under active attack, a Microsoft 'spoofing' bug turns out to be real RCE, and China loots government data.
- News
Arista Patches VeloCloud Orchestrator Zero-Day Exploited in Attacks
Arista Networks has released an emergency patch for a maximum-severity command injection zero-day in on-premises VeloCloud Orchestrator deployments that...