Arista patches VeloCloud Orchestrator zero-day exploited to gain operator control

Arista has released fixes for a critical SQL injection vulnerability in VeloCloud Orchestrator (VCO), the central management system for its VeloCloud SD-WAN product line, after the flaw was exploited in attacks as a zero-day. Tracked as CVE-2026-114625 and rated 9.9 on the CVSS scale according to The Hacker News, the bug lets any user who can log in to the orchestrator gain operator privileges, which the company describes as the ability to masquerade as a local "superuser operator" account. The advisory (24838, security advisory 0199) was published on October 22.

What happened

According to BleepingComputer, Arista said the vulnerability is being actively exploited and that attacks are low in complexity and require no user interaction. The company has not said when the attacks began, which organizations were affected or what the attackers did after gaining access, The Hacker News reported. It is also not stated who discovered the flaw.

BleepingComputer noted that this is the fourth actively exploited zero-day Arista has patched this year. The Hacker News said it is the third VCO flaw reported as exploited since late July, following CVE-2026-16812 in July and CVE-2026-93952 in September, and the first of the three that requires a login.

Technical details

The Hacker News reported that exploitation requires network access to the orchestrator's web interface and a valid login; the minimum role is Enterprise Read Only, the lowest built-in role for customer users. Once exploited, the attacker can act with full superuser access and may affect the VCO host itself, exposing, modifying or disrupting the orchestrator and the data it manages. The outlet also noted that VCO's web interface is exposed by default.

For the earlier VCO flaws, Arista warned that a compromised orchestrator could grant access to VeloCloud Edge devices; according to The Hacker News, the new advisory does not say whether that risk applies here, nor whether upgrading removes access an attacker has already obtained.

Who is affected

The affected product is the on-premises VeloCloud Orchestrator. Fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12 or later. Hosted and dedicated orchestrators have already been patched, while VeloCloud Gateway, VeloCloud Edge and the 7.0 train are not listed as affected, The Hacker News said. Orchestrators that were updated for the July and September flaws remain vulnerable, as those releases predate the new fixes. Arista has not assessed end-of-support releases and advises those customers to contact its Technical Assistance Center.

What to do

Administrators should upgrade on-premises orchestrators to the fixed releases as soon as possible. Until then, Arista recommends restricting access to the VCO web interface to trusted administrative networks, monitoring for unexpected outbound traffic from the VCO host, watching for backdoor daemons and webshells, and reviewing recent administrator activity. The company identified two attacking IP addresses, 74.82.197[.]86 and 38.54.50[.]151, which should be blocked and searched for in logs. Web access logs should also be reviewed for unusual URL-like path components, encoded characters, references to local or internal services and high request rates. If compromise is suspected, Arista advises preserving web, application, system and database logs and file-system timestamps before remediation.