#velocloud

2 articles

One SD-WAN controller has produced three entries on the exploited list since July, and each one got the shortest deadline the catalogue issues

2026-10-29Security

Counted from CISA's own feed: 1,762 entries, 278 of them added in 2026, 94 carrying a forensic triage flag that did not exist before June. Arista's VeloCloud Orchestrator holds three of the 94.

Arista's VeloCloud flaw needs a login. The lowest one the product offers will do, and the advisory says no setting prevents it

2026-10-23Security

CVE-2026-114625 is a 9.9 SQL injection that Arista found itself and says is already being exploited. An Enterprise Read Only tenant account reaches local superuser on the orchestrator.