Arista patches actively exploited VeloCloud Orchestrator zero-day | Межа

CVE-2026-114625 could let authenticated users with basic privileges gain operator access through a low-complexity SQL injection, without user interaction.

Arista Networks has released security updates for an actively exploited zero-day vulnerability affecting on-premises VeloCloud Orchestrator (VCO) deployments.

This is reported by BleepingComputer .

VCO is a web-based portal administrators use to configure, monitor and manage VeloCloud SD-WANs (Software-Defined Wide Area Networks) and associated edge devices.

Tracked as CVE-2026-114625, the critical-severity flaw affects users who have basic privileges, access to the VCO web interface and a valid authenticated session. It can allow them to escalate privileges through a low-complexity SQL injection attack that requires no user interaction.

“VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator,” – Arista

“VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator,”

“On an affected system, any authenticated user can gain operator privileges and masquerade as a local ‘superuser operator’ user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.” – Arista

“On an affected system, any authenticated user can gain operator privileges and masquerade as a local ‘superuser operator’ user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.”

Arista said it has already patched hosted VCO deployments running version 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later.

Until the patches are deployed, Arista advised administrators to monitor for connections from known malicious IP addresses, limit access to the VCO web interface to administrative networks, and check recent administrator activity for unusual changes.

The company also recommends reviewing VCO web access logs for suspicious activity, including requests with unusual URL-like path components, encoded characters, references to local or internal services, and high request rates.

Arista warned security teams to block the 74[.]82.197.86 and 38[.]54.50.151 IP addresses, which it said have been observed in ongoing attacks.

“If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible,” – Arista

“If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible,”

The company advised customers seeking further assistance to the Arista Networks Technical Assistance Center (TAC).

Arista has patched three other actively exploited zero-day vulnerabilities this year: CVE-2026-7473 in May, CVE-2026-16812 in July, and CVE-2026-93952 in September. They affected Extensible Operating System (EOS) and on-premises VeloCloud Orchestrator deployments.

We recommend paying attention to:

Microsoft warns of active zero-day attacks targeting SharePoint servers used by governments and businesses, urging urgent security updates to prevent data breaches.

A Pentagon personnel system breach exposed unencrypted personal records of 2.8 million living people and nearly 300,000 deceased, including Social Security numbers and military service details.