VeloCloud SD-WAN

Search everything

Mentions · 7d0
Mentions · 30d1
All mentions3
First seenSep 22, 2026
Last mentioned20d ago

Timeline

3 articles · newest first

Arista says VeloCloud SQL injection zero-day is exploited

A read-only login can become a local superuser; on-prem fixes are 5.2.3.18, 6.1.3.10 and 6.4.2.12.

The Hacker NewsOct 22, 19:05 UTC · 20d agoExploit / PoCExploitedCVE-2026-1146254 · 2 reads

Arista Urges Immediate Patching of Exploited VCO Zero-Day

Arista patched actively exploited VeloCloud Orchestrator zero-day CVE-2026-93952, now listed in CISA's KEV catalog.

SecurityWeekSep 23, 08:33 UTC · Sep 23, 2026Exploit / PoCExploitedCVE-2026-939521 · 1 read

New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups

Attackers are exploiting a CVSS 10.0 flaw in on-premises Arista VeloCloud Orchestrator deployments that use certificate authentication.

The Hacker NewsSep 22, 12:29 UTC · Sep 22, 2026Exploit / PoCExploitedCVE-2026-93952 CVE-2026-168121 · 1 read

Related CVEs

by mentions

CVE-2026-939521%9.5
Unauthenticated Input-Validation Flaw in VeloCloud Orchestrator (On-Prem)
published Sep 22, 2026Arista (VeloCloud; formerly VMware/Broadcom) VeloCloud Orchestrator (VCO), on-premisesKEV
CVE-2026-168122%10.0
OS Command Injection in Arista VeloCloud Orchestrator On-Prem
published Jul 27, 2026Arista VeloCloud Orchestrator On-PremKEV
CVE-2026-1146251%9.4
SQL injection in Arista VeloCloud Orchestrator grants superuser
published 20d agoArista VeloCloud OrchestratorKEVPoC

Appears with

VeloCloud Orchestratorproduct · 3
Aristavendor · 3
Broadcomvendor · 1
CISAorganization · 1

Entities are extracted by the model from each article. First seen Sep 22, 2026, last mentioned 20d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.