# IT Daily Roundup: October 23, 2026 > Oct 23, 2026 · #security #fortinet #linux #arista Actively exploited CVSS 9.9 SQL injection in Arista VeloCloud, security patches for Fortinet products, and two CVSS 9.0 Linux KSMBD RCE flaws without patches yet. ## 1. Arista VeloCloud: SQL Injection CVSS 9.9 Actively Exploited Arista disclosed CVE-2026-114625 on October 22, a SQL injection rated CVSS 9.9 in the on-premises VeloCloud Orchestrator. The flaw lets any attacker with a valid login to the web interface, including a read-only customer account, escalate to operator-level superuser access on the host server. From there, an attacker can access managed data or disrupt the entire SD-WAN network. Arista confirmed active exploitation but has not shared details about its scope. VeloCloud Gateway and Edge are not affected. Fixed releases are 5.2.3.18, 6.1.3.10, and 6.4.2.12. Hosted and Dedicated Orchestrators have already been patched automatically. If you are on an end-of-life release, contact Arista TAC. As an interim measure, restrict web interface access to trusted admin networks and review your logs for the IPs 74.82.197.86 and 38.54.50.151. > **Why this matters:** VeloCloud is often the central control point for WAN links in businesses with remote offices. An account with minimum permissions is enough for an attacker to take over the orchestrator. Do not delay patching. ## 2. Fortinet Releases Security Updates for FortiOS, FortiManager and Other Products Fortinet announced a coordinated update on October 21 and began rolling out patches on October 22 for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator. Detailed advisories with CVE numbers will follow on November 10 through the Fortinet PSIRT portal. Fortinet recommends prioritizing internet-facing devices for the update. Minimum fixed versions: FortiOS 7.2.14, 7.4.13, 7.6.8, and 8.0.2. The same version scheme applies to FortiManager and FortiAnalyzer. FortiMail requires at least 7.4.9, 7.6.7, or 8.0.2; deployments on the 7.2 branch must migrate to 7.4 or later. FortiAuthenticator is fixed in 6.6.11 and 8.0.4. FortiSASE cloud deployments receive patches automatically. > **Why this matters:** FortiGate is a common firewall in small business offices and FortiManager handles multi-device management from a single console. Without CVE numbers it is hard to judge severity, but Fortinet uses this type of coordinated announcement only for real security issues. Check your versions and schedule the update. ## 3. Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed Without Patches Two remote code execution flaws in KSMBD, the Linux kernel's built-in SMB server, were disclosed on a public mailing list on October 22. Both received a CVSS 9.0 rating from Trend Micro's Zero Day Initiative before fixes existed. The first (ZDI-CAN-33774) requires no authentication and affects any KSMBD instance reachable on port 445. The second (ZDI-CAN-33549) applies only to SMB Direct setups with an RDMA interface and a writable share. No kernel or distribution patches are available yet and no CVE numbers have been assigned. Check whether KSMBD is running on your servers: `systemctl status ksmbd` or `lsmod | grep ksmbd`. Red Hat Enterprise Linux does not include KSMBD by default. Samba is not affected. > **Why this matters:** If you do not use KSMBD, disable it and block port 445 from untrusted networks. Watch your distribution's security advisories and apply the kernel update as soon as it ships. Until then, limiting port 445 to internal traffic reduces exposure. --- © 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-10-23-it-daily-roundup.html