Arista patches VeloCloud Orchestrator zero-day exploited to gain operator control
Arista has fixed CVE-2026-114625, a CVSS 9.9 SQL injection flaw in VeloCloud Orchestrator that attackers are already exploiting to escalate any logged-in account to operator privileges.