[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQgQDAhkAy3nQ5rx98qiTPwIIEAyzPPbPm5odpEUefI8":3},{"article":4,"iocs":46,"watch_terms":57,"solutions":58,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"841f8a4f-8086-4258-890e-8220bad57d7b","Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months","attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months-5912ab","The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges. The post Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months appeared first on SecurityWeek.","Arista Networks has released patches for a critical SQL injection zero-day vulnerability (CVE-2026-114625) in its VeloCloud Orchestrator (VCO). This flaw allows authenticated users to gain operator privileges and access internal functionality. This marks the third exploited zero-day in VCO within four months, highlighting a concerning trend for the product.","Arista Networks patches third exploited VeloCloud Orchestrator zero-day in four months.","https:\u002F\u002Fwww.securityweek.com\u002Fattackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002Farista.jpeg","2026-10-23T09:58:34+00:00","2026-10-23T12:00:13.032551+00:00",9,[17,20],{"name":18,"type":19},"VeloCloud Orchestrator","product",{"name":21,"type":22},"Arista Networks","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51,55],{"type":48,"value":49,"context":50},"cve","CVE-2026-114625","SQL injection zero-day vulnerability in VeloCloud Orchestrator",{"type":52,"value":53,"context":54},"ip","74.82.197.86","IP address observed in attacks",{"type":52,"value":56,"context":54},"38.54.50.151",[21,18],{"controls":59,"vendors":147},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":90,"name":91,"problem":92,"products":93},"patch-management","Automated patch management","Known holes get closed in days, not months.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":119,"name":120,"problem":121,"products":122},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":160},"third-velocloud-orchestrator-zero-day-in-four-months-signals-systemic-patching-failure","Third VeloCloud Orchestrator Zero-Day in Four Months Signals Systemic Patching Failure","A critical SQL injection vulnerability (CVE-2026-114625) in Arista's VeloCloud Orchestrator allows authenticated users to escalate privileges to operator level, representing the third exploited zero-day in the same product within four months. The repeated exploitation pattern suggests that organizations are failing to prioritize patching for a high-value network orchestration platform, and that the vendor's own secure development lifecycle may need strengthening. SQL injection flaws are well-understood and preventable through input validation and parameterized queries, making their presence in a critical enterprise product particularly concerning. This trend underscores that attackers actively track vulnerable products and chain successive zero-days when they know defenders are slow to respond.",[153,154,155,156,157,158,159],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":161,"PCI DSS Requirement 6":162,"NIST SP 800-53 SI-2: Flaw Remediation":163,"OWASP A06:2021 Vulnerable and Outdated Components":164,"CIS Control 7: Continuous Vulnerability Management":165,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":166,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":167},"NIS2 mandates incident handling and vulnerability management for operators of essential services; the repeated exploitation of VCO zero-days would constitute a compliance failure for any EU-regulated entity using this product without timely patching.","Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches promptly; any cardholder data environment using VeloCloud Orchestrator would be directly out of compliance if critical patches are not applied within the required window.","SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes — a formal flaw remediation process would have prioritized rapid patching of a critical network orchestration platform under active exploitation.","The SQL injection zero-day in VCO represents a known vulnerability class in a critical component; OWASP A06 directly addresses the risk of running software with unpatched or newly discovered flaws in high-value systems.","Three exploited zero-days in four months indicate a broken vulnerability management cycle; CIS Control 7 mandates continuous scanning and remediation timelines that would have ensured each patch was applied before attackers could exploit it.","A.8.8 requires timely identification and remediation of technical vulnerabilities; had this control been rigorously applied, the organization would have tracked VCO's vulnerability history and escalated patching urgency after the first zero-day.","The flaw allows authenticated users to escalate to operator privileges, meaning that enforcing strict least-privilege access controls per PR.AA would have limited the blast radius even if exploitation occurred."]