Product
5 Interestana reports mention VeloCloud Orchestrator, newest first. Each links back to its publisher, with an AI summary of the original reporting where we have found no publisher terms that forbid one.
Attackers are exploiting a critical zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks. The vulnerability allows unauthorized users to gain operator privileges.
Arista disclosed on September 22 that attackers are actively exploiting a critical vulnerability in on-premises VeloCloud Orchestrator (VCO) deployments. This flaw, designated CVE-2026-93952, carries a CVSS 10.0 severity score, indicating the highest possible risk.
A critical security vulnerability affecting on-premises versions of Arista VeloCloud Orchestrator (VCO) is currently being actively exploited by malicious actors. This flaw, identified as CVE-2026-16812, has been assigned a maximum CVSS score of 10.0, indicating its severe impact.