CRITICALZero Day
Global

Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks

·Source: The Hacker News

Updated:

Executive Summary

Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. For

Analysis

Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. For
Source Attribution

Originally published by The Hacker News on Oct 22, 2026.

Related Threats

CRITICALZero Day

Security teams urged to center defense on the flaw profile attackers target most

Attackers are increasingly focusing on a limited range of critical vulnerabilities to run attacks with flaws packaged into exploits within as little as three days. Rapid7’s latest Quarterly Threat Landscape report found the number of newly exploited vulnerabilities in Q3 of 2026 was 43, up 19% year on year. Douglas McKee, director of vulnerability intelligence at Rapid7, said it would be wrong to

CSO Online
CRITICALZero Day

Arista patches new VeloCloud Orchestrator zero-day exploited in attacks

Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. [...]

BleepingComputer
CRITICALZero Day

Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/attackers-exploit-leaked-zero-day-flaws-in-widely-used-php-image_small-9-a-33161.jpg" align=right hspace=4><b>Internet-Facing Systems Now Under Attack; PHP Team Promises Imminent Patch Release</b><br>Attackers are exploiting one or more zero-day vulnerabilities in PHP after details of the bugs leaked in advance of patches being re

Bank Info Security