Observations
Record the stated conditions before the layout note
Put each figure from the page on its own line. Do not mix in a preference.
arista.com published this account (2026-10-23): Update: added to CISA KEV with dateAdded 2026-10-23 (date-only source; KEV catalog release 17:00Z; due date 2026-10-26; forensic triage required). First published 2026-10-22 in Arista Security Advisory 0199 (rev 1.0). Any authenticated VCO user, down to Enterprise Read Only, can gain operator privileges as a local superuser and reach internal-only functionality. Affected: VCO 5.2.x < 5.2.3.18, 6.1.x < 6.1.3.10, 6.4.x < 6.4.2.12 (on-prem). Hosted and Dedicated VCO already patched by Arista.
This guide uses that public page as the example. This site did not run the test, close the deal, or measure the product.
Write only what the page says
The page's claim is: Update: added to CISA KEV with dateAdded 2026-10-23 (date-only source; KEV catalog release 17:00Z; due date 2026-10-26; forensic triage required). First published 2026-10-22 in Arista Security Advisory 0199 (rev 1.0). Any authenticated VCO user, down to Enterprise Read Only, can gain operator privileges as a local superuser and reach internal-only functionality. Affected: VCO 5.2.x < 5.2.3.18, 6.1.x < 6.1.3.10, 6.4.x < 6.4.2.12 (on-prem). Hosted and Dedicated VCO already patched by Arista.
Put the URL under that sentence. If a later recap adds a number or a date, keep the original page as the record.
Put each figure from the page on its own line. Do not mix in a preference.
Do the site's check on this one page. Fill a line only when the page supports it. Where the page is silent, write Not stated.
A finished note names the page, the date, and the limit of the claim. It does not borrow a result from a different story.
Stop at the untested line
Anything you did not open, install, or count stays untested. Leave that line visible.
Source page: Arista VeloCloud Orchestrator on-prem SQL injection to superuser operator, added to CISA KEV (CVE-2026-114625, CVSS 9.9).