Arista patches exploited VeloCloud Orchestrator zero-day

Arista Networks has released security updates for CVE-2026-114625, a critical SQL injection zero-day in VeloCloud Orchestrator On-Prem reported to be actively exploited ^[1]. The flaw requires a basic-privilege account, access to the VCO web interface, and a valid authenticated session; no user interaction is required ^[1]. Arista's advisory warns that successful exploitation may affect the orchestrator's confidentiality, integrity, and availability, as well as the data it manages ^[1].

VCO is the web-based management portal used to configure, monitor, and manage VeloCloud SD-WANs and their edge devices ^[1]. Arista said that on an affected system, "any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user," including access to internal-only functionality that is not meant to be remotely accessible ^[1]. According to the advisory, hosted VCO instances are already fixed at versions 5.2.3.18, 6.1.3.10, and 6.4.2.12 or later ^[1].

Until those patches are applied, Arista recommends monitoring for connections from known malicious IP addresses, restricting VCO web interface access to administrative networks, and reviewing recent administrator activity for unusual changes ^[1]. Administrators should also review VCO web access logs for requests containing unusual URL-like paths, encoded characters, internal or local service references, or unusually high request rates ^[1].

The company told security teams to block 74[.]82.197.86 and 38[.]54.50.151, two IP addresses observed during the ongoing attacks ^[1]. For suspected compromises, Arista recommends preserving the VCO web access, backend application, system, and database logs, as well as relevant file-system timestamps before cleanup, and contacting the Arista Networks Technical Assistance Center ^[1].

This is the fourth actively exploited zero-day Arista has patched this year, after earlier patches for CVE-2026-7473, CVE-2026-16812, and CVE-2026-93952, released in May, July, and September respectively ^[1]. Earlier flaws affected Extensible Operating System and on-premises VeloCloud Orchestrator ^[1]. Arista Networks, which has more than 10,000 customers worldwide, ranks among the largest US corporations by revenue and is a Fortune 500 company ^[1].