The Exploit Bulletin — Friday, October 23, 2026: 2 issues require action
Friday, October 23, 2026 — 2 issues require action. If you run none of the software below, you are done.
Affects: VeloCloud Orchestrator On-Prem · maximhq Bifrost transports
1. SQL injection lets any authenticated user become superuser operator on VeloCloud Orchestrator on-prem (CVE-2026-114625)
PRIVILEGE ESCALATION · CRITICAL · CVSS 9.4
Arista's October 22 advisory confirms it detected this flaw, which is known to be actively exploited, and shipped fixes for all three supported lines, so an on-prem orchestrator left unpatched with any low-privilege account reachable is one login away from full compromise of the SD-WAN control plane.
A SQL injection (CWE-89) in VeloCloud Orchestrator (VCO) on-prem lets any authenticated user — including a basic read-only customer account — gain operator privileges and masquerade as the local "superuser operator", reaching internal-only functionality that was never meant to be remotely accessible. Successful exploitation compromises the confidentiality, integrity and availability of the orchestrator host and every SD-WAN edge and dataset it manages.
Affected: VeloCloud Orchestrator (VCO) On-Prem 5.2.x releases prior to 5.2.3.18; VeloCloud Orchestrator (VCO) On-Prem 6.1.x releases prior to 6.1.3.10; VeloCloud Orchestrator (VCO) On-Prem 6.4.x releases prior to 6.4.2.12; Hosted and Dedicated VCO were affected and have already been patched by Arista
How to Test: Check the VCO software version against the affected list: any 5.2.x build below 5.2.3.18, 6.1.x below 6.1.3.10, or 6.4.x below 6.4.2.12 is vulnerable; Arista has not assessed end-of-support versions, so treat those as affected. Because the attack path is any authenticated account escalating to the superuser operator, review orchestrator audit and access logs for operator-level or internal-only actions performed from customer/partner-level accounts, sessions attributed to the superuser operator from unexpected sources, and newly created or modified operator users or edge/profile configuration changes you cannot account for.
How to Patch: Upgrade VCO On-Prem to 5.2.3.18, 6.1.3.10, or 6.4.2.12 respectively. Hosted and Dedicated orchestrators have already been patched by Arista and need no customer action.
Evidence: VulnCheck KEV · Vendor confirmed · BleepingComputer: Arista patches VeloCloud Orchestrator zero-day exploited in attacks · The Hacker News: Arista warns of critical VeloCloud SQL injection zero-day exploited in attacks
2. Unauthenticated MCP client registration runs arbitrary commands on the Bifrost LLM gateway (CVE-2026-90898)
REMOTE CODE EXECUTION · CRITICAL · CVSS 9.8
VulnCheck's canary sensors recorded exploitation attempts against this endpoint on 2026-10-23, so any internet-reachable Bifrost gateway still running with the default auth-off configuration can be turned into a command-execution foothold by whoever finds it next.
Bifrost's management API lets a caller register a stdio MCP client — a command plus arguments — and the gateway executes that program the moment the client is added, with no MCP handshake required. Because the default is governance.auth_config.is_enabled=false, every caller is treated as a local admin, so a single unauthenticated POST to /api/mcp/client runs an attacker-chosen program as the Bifrost process user (appuser on the official image); the same handler also accepted unauthenticated http/sse clients pointed at loopback or private addresses, enabling SSRF against internal services including the 169.254.169.254 cloud metadata endpoint.
Affected: maximhq Bifrost transports < v2.1.0 (transports/v2.0.0 and earlier)
How to Test: Confirm which Bifrost transports release you run; anything before transports/v2.1.0 is affected. Check your configuration for governance.auth_config.is_enabled — if it is false (the default), the management API accepts unauthenticated callers as admins. Review reverse-proxy or management API access logs for POST /api/mcp/client requests from unexpected sources, particularly bodies with connection_type "stdio" or a connection_string resolving to loopback, RFC1918 or 169.254.169.254 addresses. List the currently registered MCP clients and compare them against what you provisioned in config.json; any stdio client you did not add is a compromise indicator, as are unexpected child processes under the Bifrost process user (appuser on the official image).
How to Patch: Upgrade to transports/v2.1.0, which carries fix commit 12e170352bd25eab1ae9ba16611f1797d1fd8fdc and refuses unauthenticated stdio MCP client registration and unauthenticated http/sse clients targeting loopback, private, link-local or unspecified addresses with HTTP 403 while leaving authenticated admins full access. If you cannot upgrade immediately, set governance.auth_config.is_enabled=true so the management API requires a genuine credential, restrict network access to /api/mcp/client to trusted operators, and provision any stdio MCP clients you need through config.json rather than the API.
Evidence: VulnCheck KEV
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
