Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months

A critical SQL injection vulnerability (CVE-2026-114625) in Arista's VeloCloud Orchestrator allows authenticated users to escalate privileges to operator level, representing the third exploited zero-day in the same product within four months. The repeated exploitation pattern suggests that organizations are failing to prioritize patching for a high-value network orchestration platform, and that the vendor's own secure development lifecycle may need strengthening. SQL injection flaws are well-understood and preventable through input validation and parameterized queries, making their presence in a critical enterprise product particularly concerning. This trend underscores that attackers actively track vulnerable products and chain successive zero-days when they know defenders are slow to respond.