Arista VeloCloud Orchestrator SQL Injection Vulnerability

What's happening and what to do

Attackers can send specially crafted database queries to reach privileged internal functions and affect the orchestrator host, and this flaw is being actively exploited. Arista VeloCloud Orchestrator on-prem. Apply the vendor's mitigations or update now, and check for signs of compromise.

AI summary of the sources on this page. Regenerated when a source changes.

Signals over time

2026-10-23Added to CISA's Known Exploited Vulnerabilities catalog.
2026-10-26Federal patch deadline for US agencies.
2026-11-03 21:55First seen here.

Source text

Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.