A
Oct 23, 2026Arista VeloCloud Orchestrator CVE-2026-114625: a SQL injection that crosses the privilege boundary
Technical analysis of CVE-2026-114625 in Arista VeloCloud Orchestrator.
Oct 23, 20264 min read0 reactions0 comments
Back to articles
Tag archive
#sdwan
H
Oct 23, 2026Hunting VeloCloud Orchestrator exploitation: what CVE-2026-114625 leaves in the logs
Technical analysis of CVE-2026-114625 in Arista VeloCloud Orchestrator.
Oct 23, 20263 min read0 reactions0 comments
M
Oct 23, 2026Mapping the fix: which Arista VeloCloud Orchestrator builds close CVE-2026-114625
Technical analysis of CVE-2026-114625 in Arista VeloCloud Orchestrator.
Oct 23, 20263 min read0 reactions0 comments
A
Oct 23, 2026A partner can manage many customers: why VeloCloud tenant structure raises the stakes of CVE-2026-114625
Technical analysis of CVE-2026-114625 in Arista VeloCloud Orchestrator.
Oct 23, 20263 min read0 reactions0 comments
C
Oct 23, 2026CVSS 9.9 with a login: the upgrade path VeloCloud operators face for CVE-2026-114625
Technical analysis of CVE-2026-114625 in Arista VeloCloud Orchestrator.
Oct 23, 20263 min read0 reactions0 comments
T
Oct 23, 2026Three VeloCloud Orchestrator bugs in one quarter: what CVE-2026-114625 says about the product's attack surface
Technical analysis of CVE-2026-114625 in Arista VeloCloud Orchestrator.
Oct 23, 20263 min read0 reactions0 comments
V
Oct 23, 2026VeloCloud Orchestrator CVE-2026-114625: role design, host impact and the limits of the advisory
Technical analysis of CVE-2026-114625 in Arista VeloCloud Orchestrator.
Oct 23, 20263 min read0 reactions0 comments
W
Oct 23, 2026What to fix first for CVE-2026-114625: a practical sequence for VeloCloud Orchestrator owners
Technical analysis of CVE-2026-114625 in Arista VeloCloud Orchestrator.
Oct 23, 20263 min read0 reactions0 comments
H
Oct 23, 2026Hunting CVE-2026-114625: What to Look for After the VeloCloud Orchestrator Patch
How to hunt for exploitation of CVE-2026-114625 in VeloCloud Orchestrator: log fields, attributed attacker IPs, evidence preservation order, and why the patch alone is not enough.
Oct 23, 20262 min read0 reactions0 comments
T
Oct 22, 2026Third VeloCloud Orchestrator Flaw Exploited in 2026: CVE-2026-114625 in a Pattern
CVE-2026-114625 is the third exploited VeloCloud Orchestrator flaw in 2026. What changed with the authentication requirement, and what the pattern says about patch assurance.
Oct 22, 20262 min read0 reactions0 comments
V
Oct 23, 2026VeloCloud Orchestrator Patch Triage: Three Release Trains, One Critical SQL Injection
Patch triage for CVE-2026-114625 across VeloCloud Orchestrator 5.2, 6.1 and 6.4 trains, including the stale-patch trap from earlier 2026 VCO fixes.
Oct 23, 20262 min read0 reactions0 comments
C
Oct 23, 2026CVE-2026-114625: A Read-Only Login Is Enough to Own Arista VeloCloud Orchestrator
CVE-2026-114625 in Arista VeloCloud Orchestrator lets any authenticated user, including a read-only tenant account, escalate to superuser operator. CVSS 9.9, actively exploited.
Oct 23, 20263 min read0 reactions0 comments