Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day

Arista Networks has released security updates for a zero-day vulnerability that attackers are already exploiting in the wild. The flaw affects on-premises (On-Prem) deployments of VeloCloud Orchestrator (VCO) — the web portal administrators use to configure, monitor, and manage VeloCloud SD-WAN networks and their associated edge devices.

Tracked as CVE-2026-114625 and rated critical, the bug lets an attacker with basic privileges, access to the VCO web interface, and a valid authenticated session escalate privileges through a low-complexity SQL injection that requires no user interaction.

According to Arista, successful exploitation can compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages. Any authenticated user can gain operator privileges and masquerade as a local "superuser operator," reaching functionality intended strictly for internal use and never meant to be remotely accessible.

Fixes and mitigations

The company said it has already patched its hosted VCO deployments to versions 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later.

Until patches are applied, admins are advised to restrict access to the VCO web interface to administrative networks, watch for connections from known malicious IP addresses, and review recent administrator activity for unusual changes. Web access logs should be checked for suspicious requests — unusual URL-like path components, encoded characters, references to local or internal services, and high request rates.

Arista also urged teams to block two IP addresses seen in the ongoing attacks: 74.82.197.86 and 38.54.50.151. If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system and database logs, and relevant file-system timestamps before remediation where feasible, and contact the Arista Networks Technical Assistance Center (TAC).

This is the fourth actively exploited zero-day Arista has patched this year, following CVE-2026-7473 in May, CVE-2026-16812 in July, and CVE-2026-93952 in September across its EOS software and on-premises VeloCloud Orchestrator deployments. Arista Networks is a Fortune 500 company serving more than 10,000 customers worldwide.

Source: Bleeping Computer