As cited
Copy frozen at (site build).
vulnerabilities
NCSC-2026-0459 Vulnerability fixed in Arista VeloCloud Orchestrator (VCO) on-premises
Arista patched a critical SQL injection vulnerability (CVE-2026-114625) in VeloCloud Orchestrator On-Premises that allows authenticated users with minimal privileges to execute remote code and escalate to superuser operator level. The flaw is enabled by default, cannot be mitigated through configuration, and is actively exploited in the wild. The NCSC recommends immediate patching and forensic examination of vulnerable systems for signs of prior compromise.
Why it matters: Organizations running Arista VCO On-Premises must patch immediately because the vulnerability requires only a low-privilege authenticated account, is actively exploited, and grants administrative access to the managed network infrastructure.
- Source published
- First seen by Cybersecurity Tracker