VeloCloud Orchestrator vulnerabilities

3 known vulnerabilities in VeloCloud Orchestrator from Arista Networks. 3 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  Arista VeloCloud Orchestrator SQL Injection Exploited

  CVE-2026-114625Oct 22, 2026Arista NetworksEPSS 1.03%

  VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability

• 10.0 Critical severity

  Arista VeloCloud Orchestrator Improper Input Validation Exploited

  CVE-2026-93952Sep 22, 2026Arista NetworksEPSS 1.38%

  VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability

• 10.0 Critical severity

  Arista VeloCloud Orchestrator On-Prem OS Command Injection Exploited

  CVE-2026-16812Jul 27, 2026Arista NetworksEPSS 1.76%

  VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability