5.2.3[.]18IP address
Reported by 2 independent sources · first reported by The Hacker News · last reported
Last reported yesterday
What the reports say
2 reports, newest first · the exact sentence from each-
CVE-2026-114625: Actively Exploited VeloCloud Orchestrator Flaw Grants Superuser Access“Move to VCO 5.2.3[.]18, 6.1.3.10, or 6.4.2.12, or a later release within the same branch.”
-
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks“For on-premises orchestrators, the fix is in VCO 5.2.3[.]18, 6.1.3.10, and 6.4.2.12, while Hosted and Dedicated orchestrators have already been patched.”
Indicators reported together
named in the same reports- 6.1.3[.]10in 2 reports
- 6.4.2[.]12in 2 reports
- 74.82.197[.]86in 2 reports
- 38.54.50[.]151in 2 reports
- 5.2.3[.]16in 1 report
- 6.1.3[.]7in 1 report
- 6.4.2[.]8in 1 report
Copy these 7 indicators · defanged
Also named with it: CVE-2026-16812, CVE-2026-93952, CVE-2026-114625
Thanks — we review every report.