{"id":245838,"date":"2026-10-23T01:50:48","date_gmt":"2026-10-23T06:50:48","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/10\/arista-warns-of-critical-velocloud-sql-injection-zero-day-exploited-in-attacks"},"modified":"2026-10-23T01:50:48","modified_gmt":"2026-10-23T06:50:48","slug":"arista-warns-of-critical-velocloud-sql-injection-zero-day-exploited-in-attacks","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/10\/arista-warns-of-critical-velocloud-sql-injection-zero-day-exploited-in-attacks","title":{"rendered":"Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks"},"content":{"rendered":"\n<p>Attackers are exploiting a zero-day SQL injection flaw in Arista\u2019s VeloCloud Orchestrator (VCO), the <a href=\"https:\/\/www.arista.com\/operator-guide-vc-6-4\/sd-wan-6-4-overview-of-velocloud-edge-cloud-orchestrator\" target=\"_blank\">central management system<\/a> for VeloCloud SD-WAN networks, the company said in an <a href=\"https:\/\/www.arista.com\/en\/support\/advisories-notices\/security-advisory\/24838-security-advisory-0199\" target=\"_blank\">advisory<\/a> on October 22.<\/p>\n<p>The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it.<\/p>\n<p>For on-premises orchestrators, the fix is in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12, while Hosted and Dedicated orchestrators have already been patched.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Attackers are exploiting a zero-day SQL injection flaw in Arista\u2019s VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":["post-245838","post","type-post","status-publish","format-standard","hentry","category-futurism"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/245838","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=245838"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/245838\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=245838"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=245838"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=245838"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}