Zaifliklar
Hujumchilar to'rt oy ichida uchinchi Arista VCO nol kun zaifligidan foydalanishmoqda
Kritik darajadagi SQL in'ektsiya zaifligi hujumchilarga imtiyozli ichki funksionallikka kirish va operator huquqlarini qo'lga kiritish imkonini beradi.
Muallif
Ionut Arghire
| 2026-yil 23-oktabr (ET 5:58)
*
Tarmoq yechimlari provayderi Arista Networks payshanba kuni o'zining markazlashtirilgan boshqaruv vositasi VeloCloud Orchestrator (VCO) da foydalanilayotgan nol kun zaifligi uchun tuzatishlarni e'lon qildi.
Kritik darajadagi xavfsizlik nuqsoni CVE-2026-114625 (CVSS balli 9,9) sifatida kuzatiladi va masofadan foydalanish mumkin bo'lgan SQL in'ektsiyasi sifatida tavsiflanadi.
"VeloCloud Orchestrator (VCO) on-prem tizimida xavfsizlik muammosi mavjud bo'lib, bu muammo masofadan hujumchiga imtiyozli ichki funksionallikka kirish va VCO xostiga ta'sir qilish imkonini berishi mumkin", deb ta'kidlaydi Arista o'z maslahatida.
Muvaffaqiyatli foydalanish VCO va u boshqaradigan ma'lumotlarning maxfiyligi, yaxlitligi va mavjudligiga ta'sir qilishi mumkin.
"Ta'sirlangan tizimda har qanday autentifikatsiyadan o'tgan foydalanuvchi operator huquqlarini qo'lga kiritishi va mahalliy 'superuser operator' foydalanuvchisi sifatida o'zini ko'rsatishi mumkin. Bu faqat ichki foydalanish uchun mo'ljallangan va masofadan foydalanish mumkin bo'lmagan funksionallikka kirishni o'z ichiga oladi", deb ta'kidlaydi kompaniya.
5.2.3.18, 6.1.3.10 va 6.4.2.12 dan oldingi barcha VCO versiyalari ta'sirlangan. Arista allaqachon joylashtirilgan VCO o'rnatishlarini tuzatgan, ammo foydalanuvchilarga o'zlarining mahalliy o'rnatishlarini iloji boricha tezroq yangilashni tavsiya qiladi.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
"Bu muammo Arista tomonidan aniqlangan va faol ravishda foydalanilayotgani ma'lum", deb ta'kidlaydi kompaniya.
Arista ta'kidlashicha, VCO o'rnatishlari sukut bo'yicha ochiq bo'ladi va hujumchilarga VCO veb-interfeysiga kirish va eng pastki o'rnatilgan ijarachi roli huquqlari bilan haqiqiy autentifikatsiyadan o'tgan sessiya kerak bo'ladi.
"Ta'sirni oldini oladigan hech qanday konfiguratsiya yo'q", deb ta'kidlaydi kompaniya.
Hujumlar 74.82.197.86 va 38.54.50.151 IP manzillaridan kuzatilgan. Administratorlar ularni bloklashi, ularning mavjudligi uchun jurnallarni tekshirishi va yuqori so'rov tezligini, shuningdek, g'ayrioddiy URL-ga o'xshash yo'l komponentlari, kodlangan belgilar va mahalliy yoki ichki xizmatlarga havolalarni o'z ichiga olgan so'rovlarni tekshirishi kerak.
"Agar buzilish shubha qilingan bo'lsa, operatorlar operatsion jihatdan mumkin bo'lgan hollarda tuzatishdan oldin VCO veb-kirish jurnallarini, orqa fon ilova jurnallarini, tizim jurnallarini, ma'lumotlar bazasi jurnallarini va tegishli fayl tizimi vaqt belgilarini saqlab qolishlari kerak", deb ta'kidlaydi Arista.
Tuzatilgan VCO versiyasiga yangilash tavsiya etilgan tuzatish harakati hisoblanadi. Tuzatishlar o'rnatilguncha administratorlar VCO interfeysiga kirishni cheklashi, so'nggi admin faoliyatini ko'rib chiqishi, shubhali kirishlarni kuzatishi, chiquvchi portlarni bloklashi va orqa eshik demonlari hamda vebshellarni kuzatishi kerak.
CVE-2026-114625 Arista VCO da to'rt oy ichida tuzatilgan uchinchi foydalanilayotgan nol kun zaifligi bo'lib, iyul oyida CVE-2026-16812 va sentyabr oyida CVE-2026-93952 dan keyin keladi.
Bog'liq: Atlassian Data Center va Server mahsulotlarida 75 ta zaiflikni tuzatdi
Bog'liq: Signal zaifligi zararli qo'ng'iroq qiluvchilarga qo'ng'iroqni to'xtatishni bloklash imkonini beradi
Bog'liq: Splunk, SolarWinds yangi xavfsizlik yangilanishlarini e'lon qildi
Bog'liq: Cisco bir nechta mahsulotlarda 34 ta zaiflikni tuzatdi
Yozgan: Ionut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Kundalik xabarnoma
So'nggi kiberxavfsizlik tahdidlari, tendentsiyalar va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta xabarnomasiga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Ionut Arghiredan ko'proq
- Signal zaifligi zararli qo'ng'iroq qiluvchilarga qo'ng'iroqni to'xtatishni bloklash imkonini beradi
- Splunk, SolarWinds yangi xavfsizlik yangilanishlarini e'lon qildi
- Cisco bir nechta mahsulotlarda 34 ta zaiflikni tuzatdi
- PHP2Shell foydalanish tuzatishlardan bir necha kun oldin boshlandi
- PHP2Shell tuzatishlari birinchi foydalanish urinishlari sensorlarga urilganda e'lon qilindi
- Chrome'ning 353 ta yangi xavfsizlik tuzatishlarining aksariyati xotira xatolari
- Brauzerlar qayta tiklanadigan shaxsiy kalitlar tufayli eMudhra oraliq CA'larini blokladi
- Xitoy AI modeli AQSh pudratchisi uchun yozilganda ko'proq buziladigan kod yozadi
So'nggi yangiliklar
- Sobiq 8200 bo'linma ofitserlari agentik SecOps startapi Mave uchun 34 million dollar yig'di
- Boshqa yangiliklarda: Tor chiqish relaylari o'g'irlandi, banklar noqonuniy AI agentlarini aniqladi, o'zini tiklaydigan macOS ransomware
- Mirai botnet operatorlari PHP2Shell hujumlariga qo'shildi, ASLR chetlab o'tish ekspluatlari paydo bo'ldi
- Xitoy APT ConnectWise hujumlarida AI pentest vositasi Artexdan foydalanadi
- Capcom ma'lumotlar buzilishidan 11 million kishi ta'sirlandi
- Quest Diagnostics ma'lumotlar buzilishi 'ma'lum bemor yozuvlari'ni fosh qildi
- LiteLLM yangi ta'minot zanjiri hujumida buzildi
- Atlassian Data Center va Server mahsulotlarida 75 ta zaiflikni tuzatdi
Trend
Eronning Fors shahzodasi APT 2016-yildan beri birinchi marta AQShda C&C joylashtirdi
Xitoy APT ConnectWise hujumlarida AI pentest vositasi Artexdan foydalanadi
Atlassian Data Center va Server mahsulotlarida 75 ta zaiflikni tuzatdi
Capcom ma'lumotlar buzilishidan 11 million kishi ta'sirlandi
Mirai botnet operatorlari PHP2Shell hujumlariga qo'shildi, ASLR chetlab o'tish ekspluatlari paydo bo'ldi
Sobiq 8200 bo'linma ofitserlari agentik SecOps startapi Mave uchun 34 million dollar yig'di
Boshqa yangiliklarda: Tor chiqish relaylari o'g'irlandi, banklar noqonuniy AI agentlarini aniqladi, o'zini tiklaydigan macOS ransomware
Texnologiya va xavfsizlik kompaniyalari PHP2Shell zaifliklariga javob berishmoqda
Kundalik xabarnoma
So'nggi tahdidlar, tendentsiyalar va texnologiyalar haqida xabardor bo'lish, shuningdek, soha mutaxassislarining chuqur fikrlarini olish uchun SecurityWeek elektron pochta xabarnomasiga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Vebinar: Google Workspace'dagi AI kirish xavfi allaqachon mavjud
2026-yil 19-oktabr
Google Workspace'ga ulangan AI vositalari millionlab maxfiy elektron pochta va fayllarga kirishi mumkin. Tashkilotingiz xavfini aniqlash va AI kirishini boshqarish uchun ramka o'rganish uchun ushbu sessiyaga qo'shiling.
Ro'yxatdan o'ting
Virtual tadbir: CISO Forum 2026 Sammiti
2026-yil 10 va 11-noyabr
CISO'lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantiradigan masalalarni ko'rib chiqish uchun birlashtiramiz.
Ro'yxatdan o'ting
Harakatdagi odamlar
Cequence Security Russ Schaferni CMO etib tayinladi.
Mona Harrington DHS'da Kiber integratsiya bo'yicha yordamchi direktor etib tayinlandi.
iCOUNTER Mark H. FitzPatrickni CFO etib tayinladi.
Harakatdagi ko'proq odamlar
Mutaxassis fikrlari
*
AI dasturiy ta'minot xavfsizligining kaliti tezlik emas, balki yetuklikdir
Sizning dasturchilaringiz AI qabul qilish shkalasida qayerda joylashganligi sizning xavfsizlik xavfini qanday hal qilishingizga haqiqiy ta'sir qiladi. (Matias Madou)
Zamonaviy kiberhujumlarga qarshi kurashda kontekst shohdir
Kontekstual mudofaa xavfsizlik jamoalariga signallarni bog'lash, keyingi qadamni oldindan ko'rish va tahdidlar kuchayishidan oldin ularni to'xtatishga yordam beradi. (Etay Maor)
AI hujum tezligini o'zgartirdi, xavfsizlik asoslarini emas
AI zaifliklarni aniqlash va foydalanishni tezlashtirgan sari, virtual tuzatish hali ham mudofaa chuqurligi va kuchli ilova xavfsizligi asoslariga bog'liq. (Joshua Goldfarb)
Kelajak uchun katta rejalar tuzgan to'rtta kiber tahdid
- AI, ta'minot zanjiri ta'siri, kvant hisoblash va geosiyosiy ziddiyat xavfsizlik dasturlarini sinovdan o'tkazmoqda. Buzilishlarga tayyorgarlik kundalik operatsiyalarning bir qismiga aylanishi kerak. (Steve Durbin)
Oxiridan boshlang: Agentik tuzatishni qanday yoqish mumkin
Agentik tuzatish ishonch harakati emas. Biz ma'lum muammolarni tuzatish haqida gaplashmoqdamiz, notanish xavf haqida hukm chiqarish emas. (Nadir Izrael)
Vulnerabilities
Attackers Exploit Third Arista VCO Zero-Day in Four Months
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.
By
Ionut Arghire
| October 23, 2026 (5:58 AM ET)
*
Networking solutions provider Arista Networks on Thursday rolled out patches for an exploited zero-day vulnerability in its centralized management tool VeloCloud Orchestrator (VCO).
The critical-severity security defect is tracked as CVE-2026-114625 (CVSS score of 9.9) and is described as a remotely exploitable SQL injection.
“VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host,” Arista notes in its advisory.
Successful exploitation could impact the confidentiality, integrity, and availability of both VCO and the data it manages.
“On an affected system, any authenticated user can gain operator privileges and masquerade as a local ‘superuser operator’ user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible,” the company says.
All VCO releases before versions 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected. Arista has already patched the hosted VCO deployments, but urges users to update their on-premises installations as soon as possible.
Advertisement. Scroll to continue reading.
“This issue was detected by Arista and is known to be actively exploited,” the company says.
Arista notes that VCO deployments are exposed by default, and that attackers need access to the VCO web interface and a valid authenticated session, with the lowest built-in tenant role privileges.
“There is no configuration that can prevent the exposure,” the company notes.
Attacks have been observed originating from two IP addresses, 74.82.197.86 and 38.54.50.151. Administrators should block them, check logs for their presence, and investigate high-request rates, as well as requests with unusual URL-like path components, encoded characters, and references to local or internal services.
“If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible,” Arista notes.
Updating to a fixed VCO release is the recommended remediation action. Until the fixes are deployed, administrators should restrict access to the VCO interface, review recent admin activity, monitor for suspicious access, block outbound ports, and monitor for backdoor daemons and webshells.
CVE-2026-114625 is the third exploited zero-day vulnerability Arista patches in VCO in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September.
Related:Atlassian Patches 75 Flaws in Data Center and Server Products
Related:Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Related:Splunk, SolarWinds Release Fresh Security Updates
Related:Cisco Patches 34 Vulnerabilities Across Multiple Products
Written ByIonut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Ionut Arghire
- Signal Vulnerability Lets Malicious Callers Block Hang-Ups
- Splunk, SolarWinds Release Fresh Security Updates
- Cisco Patches 34 Vulnerabilities Across Multiple Products
- PHP2Shell Exploitation Started Days Before Patches
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
- Memory Bugs Account for Most of Chrome’s 353 New Security Fixes
- Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys
- Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
Latest News
- Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
- In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
- 11 Million Impacted by Capcom Data Breach
- Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
- LiteLLM Compromised in Fresh Supply Chain Attack
- Atlassian Patches 75 Flaws in Data Center and Server Products
Trending
Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Atlassian Patches 75 Flaws in Data Center and Server Products
11 Million Impacted by Capcom Data Breach
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
Tech and Security Companies Respond to PHP2Shell Vulnerabilities
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Cequence Security has appointed Russ Schafer as CMO.
Mona Harrington has been named Assistant Director for Cyber Integration at DHS.
iCOUNTER has appointed Mark H. FitzPatrick as CFO.
More People On The Move
Expert Insights
*
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)
Four Cyber Threats Harboring Big Plans for the Future
- AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.(Steve Durbin)
Begin at the End: How to Enable Agentic Remediation
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk.(Nadir Izrael)