[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:arista-patches-third-exploited-velocloud-orchestrator-zero":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"arista-patches-third-exploited-velocloud-orchestrator-zero","rapid-alert","Arista Patches Third Exploited VeloCloud Orchestrator Zero-Day in Four Months (CVE-2026-114625)","CVE-2026-114625 is a critical SQL injection in VeloCloud Orchestrator on-prem, CVSS 9.9, actively exploited. Any authenticated user with the lowest tenant role can become a superuser operator. Patch to 5.2.3.18, 6.1.3.10 or 6.4.2.12 and hunt for abuse now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Farista-patches-third-exploited-velocloud-orchestrator-zero-714429b3-cover.png","VeloCloud VCO rapid alert: Your SD-WAN runs VeloCloud? One low tenant login owns the box.","Marcus Lenngren","2026-10-23T15:26:13.908+00:00","![VeloCloud VCO rapid alert: Your SD-WAN runs VeloCloud? One low tenant login owns the box.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Farista-patches-third-exploited-velocloud-orchestrator-zero-714429b3-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nArista Networks has patched an actively exploited zero-day in VeloCloud Orchestrator (VCO) on-prem, the web portal used to configure and manage VeloCloud SD-WANs and edge devices. The flaw is tracked as CVE-2026-114625 and carries a CVSS score of 9.9.\n\nIt is a remotely exploitable SQL injection. On an affected system, any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user. That includes access to functionality meant only for internal use and not intended to be remotely accessible. Successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and all the data it manages, and can impact the VCO host itself.\n\nThe attack is low complexity and needs no user interaction. An attacker needs access to the VCO web interface and a valid authenticated session with the lowest built-in tenant role. Arista says VCO deployments are exposed by default and that there is no configuration that can prevent the exposure.\n\nArista states the issue was detected by Arista and is known to be actively exploited. This is the third exploited VCO zero-day in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September.\n\n## Timeline\n\n- Jul 2026: CVE-2026-16812 patched, actively exploited.\n- Sep 2026: CVE-2026-93952 patched, actively exploited.\n- 22 Oct 2026: Arista releases the patch for CVE-2026-114625; hosted VCO deployments already patched by Arista.\n- 22 Oct 2026: Active exploitation confirmed, two attacker IPs observed.\n\n## Am I affected?\n\nYou are affected if you run VeloCloud Orchestrator on-prem on any release before the fixed versions. All VCO releases before 5.2.3.18, 6.1.3.10 and 6.4.2.12 are affected.\n\nHosted VCO deployments have already been patched by Arista to 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later, so no action is needed there.\n\nCheck your running version in the VCO UI (Help then About). Remember that even low-privilege tenant accounts can be used, so anyone with a valid login to the web interface is a potential entry point.\n\n## What to do now\n\n1. Update on-prem VCO to a fixed release: 5.2.3.18, 6.1.3.10 or 6.4.2.12, matching your current branch. This is the recommended remediation.\n2. Block the two attacker IPs seen in live attacks: 74.82.197.86 and 38.54.50.151.\n3. Restrict access to the VCO web interface to administrative networks only until you have patched.\n4. Block outbound ports and monitor for backdoor daemons and webshells.\n5. Review recent administrator activity for unusual changes, and monitor for suspicious access.\n6. If you suspect compromise, preserve VCO web access logs, backend application logs, system logs, database logs and relevant file-system timestamps before remediation where operationally feasible, then contact the Arista TAC.\n\n## How to hunt\n\n- Search VCO web access logs for connections from 74.82.197.86 and 38.54.50.151.\n- Look for high request rates against the VCO web interface.\n- Look for requests with unusual URL-like path components, encoded characters, and references to local or internal services, which fit the SQL injection pattern.\n- Review admin and operator activity for accounts that suddenly gained superuser operator access or performed changes that do not match normal operations.\n- Watch the VCO host for new or unexpected daemons and webshells, and for unexpected outbound connections.\n\n## What does not help\n\nHardening the configuration alone will not protect you. Arista states that VCO is exposed by default and there is no configuration that can prevent the exposure. Restricting the web interface and blocking the known IPs buy time, but they are not a fix. Only updating to a fixed VCO release removes the vulnerability.\n\n## Sources\n\n- [Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months](https:\u002F\u002Fwww.securityweek.com\u002Fattackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months\u002F), SecurityWeek, 23 Oct\n- [Arista patches new VeloCloud Orchestrator zero-day exploited in attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Farista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks\u002F), BleepingComputer, 22 Oct\n- [Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks](https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Farista-warns-of-critical-velocloud-sql.html), The Hacker News, 22 Oct\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,45],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"gheist-campaign-abuses-stolen-github-tokens-to-dump-private","Gheist campaign abuses stolen GitHub tokens to dump private repo and cloud secrets via Actions logs","Since 15 Sep 2026, the Gheist campaign has planted a sync-check workflow in over 13,500 branches using stolen GitHub tokens, printing secrets to Actions logs and pulling them before deleting the run. Public repos are protected by a GitHub hold, but private repos and GitHub Enterprise Server are not.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fgheist-campaign-abuses-stolen-github-tokens-to-dump-private-1032a4f5-cover.png","Gheist rapid alert: Stolen GitHub token, private repo? Every secret in it got printed.","2026-10-27T05:06:27.466+00:00",{"slug":37,"kind":38,"title":39,"excerpt":40,"cover_image_url":41,"cover_image_alt":42,"author_name":11,"published_at":43,"reading_minutes":44},"honeypots-see-attacks-first","analysis","Honeypots see attacks before the patch, but how do companies act on it?","Amazon's decoys are probed within 90 seconds of going online. What deception and honeypots do for the security community, and six small steps that let an ordinary team act on early warnings with the people it has.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fblog\u002Fai-1f0002b6-fc7e-49f4-9d6c-fb41c50beb17.png","A decoy server is immediately surrounded by incoming attack probes and attempts on a dark digital background.","2026-10-26T06:27:00+00:00",8,{"slug":46,"kind":6,"title":47,"excerpt":48,"cover_image_url":49,"cover_image_alt":50,"author_name":11,"published_at":51,"reading_minutes":18},"node2shell-node-js-brotli-decoder-rce-cve-2026-111497","Node2Shell: Node.js Brotli decoder RCE (CVE-2026-111497) patched in all supported lines","Node.js fixed an out-of-bounds write in its bundled Brotli decoder on 21 October. Imperva's Node2Shell PoC ran code on an official 24.22.0 build. Upgrade to 22.23.4, 24.22.1 or 26.12.1. There is no workaround in Node.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fnode2shell-node-js-brotli-decoder-rce-cve-2026-111497-e52ba6df-cover.png","Node2Shell rapid alert: Does your service decode Brotli? One crafted stream can run code.","2026-10-23T16:42:51.248+00:00"]