Arista has issued a warning about a critical zero-day SQL injection vulnerability being exploited in its VeloCloud Orchestrator (VCO). The VCO is the central management system for VeloCloud SD-WAN networks.
The flaw allows any user with login access to the orchestrator, even with a read-only customer account, to gain operator privileges. This represents the highest level of control over the system.
Sources and references
Original report
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 005GZ6BA
Cite this
APA
Interestana AI Editorial. (2026, October 22). Arista VeloCloud Zero-Day SQL Injection Exploited. Interestana. https://interestana.com/articles/arista-warns-of-critical-velocloud-sql-injection-zero-day-exploited-in-attacks-005gz6ba
MLA
“Arista VeloCloud Zero-Day SQL Injection Exploited.” Interestana, 22 Oct. 2026, interestana.com/articles/arista-warns-of-critical-velocloud-sql-injection-zero-day-exploited-in-attacks-005gz6ba.
Chicago
Interestana AI Editorial. “Arista VeloCloud Zero-Day SQL Injection Exploited.” Interestana, October 22, 2026. https://interestana.com/articles/arista-warns-of-critical-velocloud-sql-injection-zero-day-exploited-in-attacks-005gz6ba.
BibTeX
@misc{interestana_005gz6ba,
author = {{Interestana AI Editorial}},
title = {{Arista VeloCloud Zero-Day SQL Injection Exploited}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/arista-warns-of-critical-velocloud-sql-injection-zero-day-exploited-in-attacks-005gz6ba},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html}
}Credit the source
Original reporting: The Hacker News, “Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks”, https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe