Check Point weekly brief covers Onamae intrusion, PHP exploits, GitLab RCE
The October 26 bulletin also flags an exploited Arista flaw, a LiteLLM package compromise, and the Aokigahara infostealer.
Stories per day · 30 days
3 RSS
Relatedarista8sql-injection8sd-wan6kev3orchestrator3zero-day3cisa2active-exploitation1actively-exploited1cisa-kev1collabora1gitlab1infostealer1litellm1nextcloud1php1privilege-escalation1shinyhunters1
18 stories, newest first · one card per story
Stories tagged #velocloud
CISA adds exploited Arista VeloCloud Orchestrator flaw to KEV
Authenticated SQL injection CVE-2026-114625 can grant operator privileges; federal agencies must fix it by October 26, 2026.
CISA adds exploited Collabora Online and VeloCloud flaws to KEV
FCEB agencies must patch command injection in Collabora CODE Server and SQL injection in on-prem VeloCloud Orchestrator by October 26.
Attackers exploit VeloCloud Orchestrator flaw for superuser access
CVE-2026-114625 is an authenticated SQL injection; Enterprise Read Only is enough, and Arista named two attacking IPs.
2
Arista says VeloCloud Orchestrator flaw CVE-2026-114625 is exploited
Builds before 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected; Canada's Cyber Centre urges available updates.
CISA adds exploited Arista VeloCloud Orchestrator SQL injection to KEV
CVE-2026-114625 is listed on evidence of active exploitation; FCEB agencies must prioritize remediation under BOD 26-04.
Attackers exploit VeloCloud Orchestrator SQL injection zero-day CVE-2026-114625
Any authenticated user on unpatched on-prem VCO can become a superuser operator; Arista says hosted systems are already patched.
Actively exploited VeloCloud Orchestrator flaw grants superuser access
The headline names CVE-2026-114625 as exploited; the supplied page text does not state versions or a fix.
1
CISA adds exploited Arista VeloCloud Orchestrator flaw to KEV
Authenticated users can become a superuser operator on on-prem VCO; federal due date is October 26, 2026.
Arista says VeloCloud SQL injection zero-day is exploited
A read-only login can become a local superuser; on-prem fixes are 5.2.3.18, 6.1.3.10 and 6.4.2.12.
Arista patches VeloCloud zero-day exploited in attacks
CVE-2026-114625 SQL injection flaw in VeloCloud Orchestrator allows authenticated privilege escalation.
On-prem VeloCloud Orchestrator under attack, only some versions patched
Arista warns the actively exploited CVSS 10.0 VeloCloud Orchestrator flaw CVE-2026-93952 has patches for only some affected release trains.
U.S. CISA adds Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its Known Exploited Vulnerabilities catalog
CISA added four actively exploited Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its KEV catalog, with federal fixes due September 25.
Arista patches actively exploited VeloCloud Orchestrator zero-day
Arista patches critical zero-day (CVE-2026-93952) in VeloCloud Orchestrator being actively exploited, allowing unauthenticated access to privileged host functions.
6
Arista Urges Immediate Patching of Exploited VCO Zero-Day
Arista patched actively exploited VeloCloud Orchestrator zero-day CVE-2026-93952, now listed in CISA's KEV catalog.
Arista Networks security advisory (AV26-947)
Canada's Cyber Centre warns CVE-2026-93952 in Arista VeloCloud Orchestrator is being exploited in the wild.
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
Attackers are exploiting a CVSS 10.0 flaw in on-premises Arista VeloCloud Orchestrator deployments that use certificate authentication.
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited Check Point, Arista VeloCloud, and F5 BIG-IP flaws to the KEV catalog.