Volt Typhoon used rotating Silent Train relays for zero-days
Lumen says exploited products included Versa, N-able, Cisco SD-WAN, VeloCloud and possibly Quest KACE; KeyDrift hit Cisco controllers.
86
Product
VeloCloud Orchestrator
- Mentions · 7d0
- Mentions · 30d17
- All mentions23
- First seenSep 22, 2026
- Last mentioned13d ago
Timeline
23 articles · newest firstVolt Typhoon used Silent Train for US zero-day intrusions
Lumen says four confirmed zero-day campaigns hit management platforms, with credential theft and chains of compromised devices.
84
Volt Typhoon used Silent Train relays to hide zero-day attacks
Lumen links the relay network to four confirmed zero-days and one likely flaw, with sessions rebuilt in under two minutes.
84
Volt Typhoon Exploits Zero-Days to Breach Critical Infrastructure
Volt Typhoon built Silent Train framework using zero-days in Quest KACE, N-central, Cisco SD-WAN and VeloCloud to access U.S. critical infrastructure.
80
Volt Typhoon used Silent Train in four zero-day campaigns
Black Lotus Labs says the rotating SOHO and IoT relay network hit hundreds of victims, including US critical infrastructure.
84
Volt Typhoon uses Silent Train relays for zero-day edge attacks
Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.
86
Volt Typhoon rebuilt Silent Train relay chains since late 2023
Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.
84
Check Point weekly brief covers Onamae intrusion, PHP exploits, GitLab RCE
The October 26 bulletin also flags an exploited Arista flaw, a LiteLLM package compromise, and the Aokigahara infostealer.
66
CISA adds exploited Arista VeloCloud Orchestrator flaw to KEV
Authenticated SQL injection CVE-2026-114625 can grant operator privileges; federal agencies must fix it by October 26, 2026.
78
CISA adds exploited Collabora Online and VeloCloud flaws to KEV
FCEB agencies must patch command injection in Collabora CODE Server and SQL injection in on-prem VeloCloud Orchestrator by October 26.
84
Attackers exploit VeloCloud Orchestrator flaw for superuser access
CVE-2026-114625 is an authenticated SQL injection; Enterprise Read Only is enough, and Arista named two attacking IPs.
84
Arista says VeloCloud Orchestrator flaw CVE-2026-114625 is exploited
Builds before 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected; Canada's Cyber Centre urges available updates.
74
CISA adds exploited Arista VeloCloud Orchestrator SQL injection to KEV
CVE-2026-114625 is listed on evidence of active exploitation; FCEB agencies must prioritize remediation under BOD 26-04.
74
Attackers exploit VeloCloud Orchestrator SQL injection zero-day CVE-2026-114625
Any authenticated user on unpatched on-prem VCO can become a superuser operator; Arista says hosted systems are already patched.
82
Actively exploited VeloCloud Orchestrator flaw grants superuser access
The headline names CVE-2026-114625 as exploited; the supplied page text does not state versions or a fix.
76
CISA adds exploited Arista VeloCloud Orchestrator flaw to KEV
Authenticated users can become a superuser operator on on-prem VCO; federal due date is October 26, 2026.
74
Arista says VeloCloud SQL injection zero-day is exploited
A read-only login can become a local superuser; on-prem fixes are 5.2.3.18, 6.1.3.10 and 6.4.2.12.
84
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
CISA added exploited FortiMail flaw CVE-2026-104286, a critical unauthenticated file-write bug, to the KEV catalog.
86
Arista patches actively exploited VeloCloud Orchestrator zero-day
Arista patches critical zero-day (CVE-2026-93952) in VeloCloud Orchestrator being actively exploited, allowing unauthenticated access to privileged host functions.
95
Arista Urges Immediate Patching of Exploited VCO Zero-Day
Arista patched actively exploited VeloCloud Orchestrator zero-day CVE-2026-93952, now listed in CISA's KEV catalog.
88
Arista Networks security advisory (AV26-947)
Canada's Cyber Centre warns CVE-2026-93952 in Arista VeloCloud Orchestrator is being exploited in the wild.
76
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
Attackers are exploiting a CVSS 10.0 flaw in on-premises Arista VeloCloud Orchestrator deployments that use certificate authentication.
87
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited Check Point, Arista VeloCloud, and F5 BIG-IP flaws to the KEV catalog.
80
Related CVEs
by mentions- CVE-2026-1146251%9.4SQL injection in Arista VeloCloud Orchestrator grants superuser
- CVE-2026-168122%10.0OS Command Injection in Arista VeloCloud Orchestrator On-Prem
- CVE-2026-2012788%10.0Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
- CVE-2026-939521%9.5Unauthenticated Input-Validation Flaw in VeloCloud Orchestrator (On-Prem)
- CVE-2025-88752%9.4Insecure Deserialization Code Execution in N-able N-central (KEV)
- CVE-2025-88764%9.4OS Command Injection in N-able N-central Before 2025.3.1
- CVE-2024-397174%7.2Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon
- CVE-2026-8510254%9.8Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw
- CVE-2026-9361692%9.8Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload
- CVE-2026-9412727%9.3Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile
Appears with
- Aristavendor · 12
- CISAorganization · 9
- Ciscovendor · 8
- Volt Typhoonthreat actor · 7
- Black Lotus Labsorganization · 7
- Versa Directorproduct · 6
- N-centralproduct · 5
- Versavendor · 5
- N-ablevendor · 5
- Questvendor · 5
- Cisco Catalyst SD-WANproduct · 4
- Arista Networksvendor · 4
- Fortinetvendor · 3
- Lumenorganization · 3
- Quest KACEproduct · 3
- KACEproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.