Volt Typhoon Exploits Zero-Days to Breach Critical Infrastructure
Volt Typhoon built Silent Train framework using zero-days in Quest KACE, N-central, Cisco SD-WAN and VeloCloud to access U.S. critical infrastructure.
80
Vendor
Arista
- Mentions · 7d0
- Mentions · 30d9
- All mentions14
- First seenSep 22, 2026
- Last mentioned13d ago
Timeline
14 articles · newest firstVolt Typhoon used Silent Train in four zero-day campaigns
Black Lotus Labs says the rotating SOHO and IoT relay network hit hundreds of victims, including US critical infrastructure.
84
Eclypsium report details exploited flaws in firewalls, VPNs and network appliances
InfraTrust tracked 133 new advisories covering 2,813 vulnerabilities in a month; 16 advisories involved actively exploited KEV-listed flaws.
90
Check Point weekly brief covers Onamae intrusion, PHP exploits, GitLab RCE
The October 26 bulletin also flags an exploited Arista flaw, a LiteLLM package compromise, and the Aokigahara infostealer.
66
CISA adds exploited Arista VeloCloud Orchestrator flaw to KEV
Authenticated SQL injection CVE-2026-114625 can grant operator privileges; federal agencies must fix it by October 26, 2026.
78
CISA adds exploited Collabora Online and VeloCloud flaws to KEV
FCEB agencies must patch command injection in Collabora CODE Server and SQL injection in on-prem VeloCloud Orchestrator by October 26.
84
CISA adds exploited Arista VeloCloud Orchestrator SQL injection to KEV
CVE-2026-114625 is listed on evidence of active exploitation; FCEB agencies must prioritize remediation under BOD 26-04.
74
CISA adds exploited Arista VeloCloud Orchestrator flaw to KEV
Authenticated users can become a superuser operator on on-prem VCO; federal due date is October 26, 2026.
74
Arista says VeloCloud SQL injection zero-day is exploited
A read-only login can become a local superuser; on-prem fixes are 5.2.3.18, 6.1.3.10 and 6.4.2.12.
84
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
CISA added exploited FortiMail flaw CVE-2026-104286, a critical unauthenticated file-write bug, to the KEV catalog.
86
Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances
CISA adds four actively exploited zero-days to KEV, forcing immediate patching of critical flaws in Check Point, Arista, and F5 systems.
90
Arista Urges Immediate Patching of Exploited VCO Zero-Day
Arista patched actively exploited VeloCloud Orchestrator zero-day CVE-2026-93952, now listed in CISA's KEV catalog.
88
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
Attackers are exploiting a CVSS 10.0 flaw in on-premises Arista VeloCloud Orchestrator deployments that use certificate authentication.
87
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited Check Point, Arista VeloCloud, and F5 BIG-IP flaws to the KEV catalog.
80
Related CVEs
by mentions- CVE-2026-1146251%9.4SQL injection in Arista VeloCloud Orchestrator grants superuser
- CVE-2026-939521%9.5Unauthenticated Input-Validation Flaw in VeloCloud Orchestrator (On-Prem)
- CVE-2026-9361692%9.8Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload
- CVE-2026-9412727%9.3Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile
- CVE-2026-168122%10.0OS Command Injection in Arista VeloCloud Orchestrator On-Prem
- CVE-2026-8510254%9.8Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw
- CVE-2026-8877277%9.5Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway
- CVE-2026-8877182%9.5Unauthenticated RCE in Citrix NetScaler ADC and Gateway
- CVE-2025-88764%9.4OS Command Injection in N-able N-central Before 2025.3.1
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
Appears with
- VeloCloud Orchestratorproduct · 12
- CISAorganization · 9
- Ciscovendor · 4
- Check Pointvendor · 3
- F5vendor · 3
- VeloCloud SD-WANproduct · 3
- Fortinetvendor · 3
- Citrixvendor · 2
- Palo Alto Networksvendor · 2
- Arista VeloCloud Orchestratorproduct · 2
- NetScaler ADCproduct · 2
- Volt Typhoonthreat actor · 2
- N-centralproduct · 2
- N-ablevendor · 2
- KACEproduct · 2
- F5 BIG-IP APMproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.