[arista]

October 25, 2026

• CISA added Arista VeloCloud Orchestrator CVE-2026-114625 (CVSS 9.9) and Collabora Online CVE-2026-110447 (CVSS 9.2) to KEV, with an October 26 federal deadline. The VeloCloud SQL injection needs only an authenticated session at Enterprise Read Only level to reach privileged internal functionality; Arista named two Japan-geolocated IPs but no actor. It is the third weaponised VCO flaw since July 2026, after CVE-2026-16812 and CVE-2026-93952. The Collabora command injection is being used to drop web shells on Nextcloud servers and hunt for credential stores, password-manager artifacts and crypto wallets. (The Hacker News) · Vulnerabilities & Exploits

in When the Red Team Is the Model: OpenAI's Agents Escaped Their Own Sandbox

October 23, 2026

• Arista is patching an exploited VeloCloud Orchestrator zero-day. CVE-2026-114625 (CVSS 9.9) is a low-complexity SQL injection in on-prem VCO that lets any authenticated user — down to the lowest Enterprise Read Only tenant role — reach operator privileges and masquerade as a local superuser operator. Arista found it itself, says it is known to be actively exploited, has patched hosted deployments, and lists two attacker IPs to block. BleepingComputer, Arista advisory 0199 · Vulnerabilities & Exploits

in Two Unpatched KSMBD RCEs Go Public — and an AI Scanner Found Them

September 24, 2026

• Arista ships VCO patches and IoCs. CVE-2026-93952 affects VeloCloud Orchestrator On-Prem where Edge-to-VCO certificate authentication is configured; exploitation requires only the public portion of the Edge certificate and network access to the VCO web interface, no tenant or operator credentials. Hosted deployments on 5.2.3.16+/6.4.2.8+ are patched, with fixes pending for 6.1.3.7 and below and 7.0.0.2 and below. Arista advises blocking 142.93.149.77 and 104.248.126.159 and grepping nginx logs for the x-vc-opt header; the CISA KEV remediation date for federal agencies is Friday 25 September (BleepingComputer). · Vulnerabilities & Exploits

in The Exploit Is Public, the Ubuntu Patch Isn't

September 23, 2026

• Arista VeloCloud Orchestrator CVE-2026-93952 carries a CVSS 10.0 and is confirmed actively exploited. Only on-prem orchestrators using certificate-based Edge authentication are exposed, and the attacker needs network access to the VCO web interface plus the public part of an Edge certificate. As of 22 September, fixes exist for the 5.2 and 6.4 trains but not 6.1 or 7.0; Hosted and Dedicated are already patched (The Hacker News). · Exploited in the Wild

in Attack Chains That Run Themselves

July 29, 2026

• Arista VeloCloud Orchestrator is under active exploitation as a zero-day. The on-prem OS command-injection flaw (CVSS 10.0, tracked as CVE-2026-16812 in vendor reporting) lets a remote attacker reach privileged internal functionality and run arbitrary code (Arista advisory, SecurityWeek) (earlier coverage). (discussion) · Vulnerabilities & Exploits

in Artifactory Zero-Days Confirmed as the Hugging Face AI Agent's Escape Route

July 28, 2026

• Arista patched a VeloCloud Orchestrator zero-day that was exploited in attacks — a reminder that SD-WAN orchestration planes remain high-value initial-access targets (BleepingComputer). · Vulnerabilities & Exploits

in Agentic AI Muscles Into the Offensive Toolkit