Arista patches actively exploited VeloCloud Orchestrator zero-day CVE-2026-114625 (CVSS 9.9, authenticated SQL injection)
Arista Networks released security updates for CVE-2026-114625, a critical (CVSS 9.9) zero-day SQL injection in VeloCloud Orchestrator (VCO) that is being actively exploited. Any authenticated user, even with the lowest built-in Enterprise Read Only role, who can reach the VCO web interface can escalate to operator privileges and masquerad…