VeloCloud Orchestratorに重大な欠陥、悪用を確認
Summary
Aristaは、SD-WAN管理基盤VeloCloud Orchestrator(VCO)のSQLインジェクションの脆弱性CVE-2026-114625(CVSS 9.9)が、実際の攻撃で悪用されていると伝えています。自社でオンプレミス版のVCOを運用している組織が影響を受けるため、修正版へのアップグレードを急ぐ必要があります。あわせて管理画面の公開範囲を絞り、侵入の形跡がないかの確認も進めてください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
Aristaは、SD-WAN管理基盤VeloCloud Orchestrator(VCO)のSQLインジェクションの脆弱性CVE-2026-114625(CVSS 9.9)が、実際の攻撃で悪用されていると伝えています。自社でオンプレミス版のVCOを運用している組織が影響を受けるため、修正版へのアップグレードを急ぐ必要があります。あわせて管理画面の公開範囲を絞り、侵入の形跡がないかの確認も進めてください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Arista Networks | VeloCloud Orchestrator |
≥ 5.2.0, < 5.2.3.18 ≥ 6.1.0, < 6.1.3.10 ≥ 6.4.0, < 6.4.2.12 |
5.2.3.18 6.1.3.10 6.4.2.12 |
Original description The description as published by the source.
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Source: Security Online NVD GitHub Advisory CISA KEV
References
- patch psirt@arista.com
- SECURITYONLINE Arista Warns VeloCloud Orchestrator Flaw CVE-2026-114625 Is Exploited in the Wild
- web nvd.nist.gov
- web github.com
- web cisa.gov