Search — “38.54.50.151”

Arista disclosed CVE-2026-114625 (CVSS 9.9), a remotely exploitable SQL injection in on-premises VeloCloud Orchestrator (VCO) that is known to be actively exploited. Per the vendor, any authenticated user with the lowest built-in tenant role can gain operator privileges and masquerade as a local superuser operator. Hunters should review VCO web access logs for requests from 74.82.197.86 and 38.54.50.151, look for high request rates and URL-like path components, encoded characters, and references to local or internal services, and watch for backdoor daemons and webshells.