6.4.2[.]12IP address
Reported by 3 independent sources · first reported by The Hacker News · last reported
Last reported today
What the reports say
4 reports, newest first · the exact sentence from each-
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud“(Fixed in October 2026 in versions 5.2.3.18, 6.1.3.10, and 6.4.2[.]12)”
-
Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months“All VCO releases before versions 5.2.3.18, 6.1.3.10, and 6.4.2[.]12 are affected.”
-
CVE-2026-114625: Actively Exploited VeloCloud Orchestrator Flaw Grants Superuser Access“Move to VCO 5.2.3.18, 6.1.3.10, or 6.4.2[.]12, or a later release within the same branch.”
-
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks“For on-premises orchestrators, the fix is in VCO 5.2.3.18, 6.1.3.10, and 6.4.2[.]12, while Hosted and Dedicated orchestrators have already been patched.”
Indicators reported together
named in the same reports- 6.1.3[.]10in 4 reports
- 74.82.197[.]86in 4 reports
- 38.54.50[.]151in 4 reports
- 5.2.3[.]18in 2 reports
- 5.2.3[.]16in 1 report
- 6.1.3[.]7in 1 report
- 6.4.2[.]8in 1 report
Copy these 7 indicators · defanged
Also named with it: CVE-2026-16812, CVE-2026-93952, CVE-2026-114625, CVE-2026-110447
Thanks — we review every report.