Arista patches exploited VeloCloud Orchestrator zero

Feeds.4Sysops •IT News • October 22, 2026

VeloCloud Orchestrator (VCO) is a web-based portal for managing software-defined wide-area networks (SD-WAN) and their edge devices. Arista says attackers are exploiting a critical flaw in on-premises VCO that lets any authenticated user gain elevated operator privileges. Customers should upgrade to a fixed release and check for signs of compromise. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Zero-Day in Arista VeloCloud Orchestrator Actively Exploited Arista Networks has patched a critical SQL injection vulnerability, CVE-2026-114625, in its VeloCloud Orchestrator (VCO) that allows authenticated users to escalate privileges to superuser status. The flaw, rated 9.9 on the CVSS scale, has been actively exploited in the wild, affecting on-premises deployments of VCO. Attackers can exploit the vulnerability by logging in with valid credentials, even those with read-only access. Arista has released patches for affected versions 5.2.3.18, 6.1.3.10, and 6.4.2.12, while hosted deployments have already been secured. This incident marks the third zero-day vulnerability disclosed in VCO since July 2026. Security teams are advised to monitor for suspicious activity and block specific IP addresses associated with the attacks. 18 sources 73

Extracted Entities

Arista patches exploited VeloCloud Orchestrator zero

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Platforms (1)