type: cve · created: 2026-10-23 · updated: 2026-10-23 · tags: [cve] · confidence: medium · severity: critical · affected_sectors: [global] · au_impact: false
Arista warned on 22 October that attackers are exploiting a SQL injection zero-day in VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, tracked as CVE-2026-114625 and rated 9.9.
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-114625 |
| CVSS | 9.9 (CRITICAL) |
| Vendor / product | Not stated |
| Reported | 2026-10-23 |