Arista Networks Security Advisories (incl. VeloCloud Orchestrator)
arista-security-advisories · A · candidate
https://www.arista.com/en/support/advisories-notices/security-advisory
Added 2026-10-23 (2026-10-23T0256Z-intel): S1 candidate: first-party PSIRT for the VeloCloud Orchestrator line, which has had three vendor-confirmed exploited flaws in 2026 (CVE-2026-16812, CVE-2026-93952, CVE-2026-114625); `extract` reads each advisory page and every advisory has a CSAF at arista.com/assets/data/SecurityAdvisories/CSAF/arista_networks_security_advisory_<n>_CSAF.json.
Cited in 5 entries
Citation cadence
Citation days per ISO week (20 weeks of coverage span, total 4).
- CVE-2026-114625, Arista VeloCloud Orchestrator On-Prem: an SQL injection lets any authenticated user, down to the Enterprise Read Only role, act as a superuser operator, and Arista says it is actively exploited (CVSS 3.1 9.9)2026-10-23
- CVE-2026-93952, Arista VeloCloud Orchestrator: actively exploited, two release trains still have no fix2026-09-23
- CVE-2026-16812, Arista VeloCloud Orchestrator on-prem: unauthenticated OS command injection on an interface exposed by default, confirmed exploited (CVSS 10.0)2026-07-28
- CVE-2026-7473, Arista EOS tunnel-decapsulation logic flaw bypasses segmentation, added to CISA KEV2026-06-10
- CVE-2026-47344 et al. TYPO3 core June release: 13 CVEs across every supported branch (10.4 ELTS → 14.3 LTS)2026-06-10