October 23, 2026
- Arista is patching an exploited VeloCloud Orchestrator zero-day. CVE-2026-114625 (CVSS 9.9) is a low-complexity SQL injection in on-prem VCO that lets any authenticated user — down to the lowest Enterprise Read Only tenant role — reach operator privileges and masquerade as a local superuser operator. Arista found it itself, says it is known to be actively exploited, has patched hosted deployments, and lists two attacker IPs to block. BleepingComputer, Arista advisory 0199 · Vulnerabilities & Exploits
in Two Unpatched KSMBD RCEs Go Public — and an AI Scanner Found Them