Arista is issuing security updates for a critical SQL injection vulnerability in VeloCloud Orchestrator (VCO) that is being exploited in attacks. Dev-to frames the issue as a patch triage problem for on-premises administrators running specific VCO “release trains,” while The Hacker News and Bleeping Computer emphasize that Arista warns the flaw is actively targeted and that exploitation enables escalation from read-only access to operator-level privileges.
According to Dev-to, the vulnerability is addressed only in three specific fixed builds on the affected on-prem trains: 5.2.3.18, 6.1.3.10, and 6.4.2.12. It also says that “stale-patch” situations can persist when earlier patches for other VeloCloud Orchestrator flaws were applied but do not bring systems onto the new fixed builds. Dev-to adds that VeloCloud Gateway and VeloCloud Edge are not affected, and that unsupported releases should be treated as unknown and routed to Arista TAC for upgrade guidance.
Across outlets, coverage consistently centers on VCO on-prem systems, active exploitation, and the need to apply the correct update. The main differences are how each outlet presents scope (version trains and fixed builds versus a broader “zero-day” alert) and the level of implementation detail.
