Arista Patches Exploited VeloCloud Orchestrator Zero-Day

Arista Networks has patched a critical zero-day vulnerability in its on-premises VeloCloud Orchestrator (VCO), a tool used to manage network services. The flaw, tracked as CVE-2026-114625, is an SQL injection vulnerability that can be exploited remotely by an authenticated user.

The vulnerability has a CVSS severity score of 9.9. Successful exploitation can give any authenticated user operator privileges, including users with the lowest built-in tenant role. Attackers can impersonate a local “superuser operator” account and access functions intended for internal use. The attack could affect the confidentiality, integrity and availability of VCO and the data it manages.

VCO releases earlier than 5.2.3.18, 6.1.3.10 and 6.4.2.12 are affected. Arista has patched its hosted VCO deployments and has urged customers to update on-premises systems as soon as possible.

“This issue was detected by Arista and is known to be actively exploited,” the company’s security advisory states. VCO deployments are exposed by default. An attacker needs access to the VCO web interface and a valid authenticated session. No configuration change can prevent the exposure, according to the advisory.

Arista observed attacks from the IP addresses 74.82.197.86 and 38.54.50.151. Administrators should block the addresses, check logs for connections from them and investigate unusually high request rates. The company also recommends reviewing requests that contain unusual URL-like path components, encoded characters or references to local and internal services.

If a compromise is suspected, operators should preserve VCO web access, backend application, system and database logs, as well as relevant file-system timestamps, before remediation when operationally feasible. Until the software is updated, Arista recommends restricting access to the VCO interface, reviewing recent administrator activity, monitoring for suspicious access, blocking outbound ports and checking for backdoor daemons and web shells.

CVE-2026-114625 is the third exploited VCO zero-day Arista has patched in four months. The company fixed CVE-2026-16812 in July and CVE-2026-93952 in September.