Attackers Exploit Third VeloCloud Orchestrator Zero

Networking solutions provider Arista Networks on Thursday rolled out patches for an exploited zero-day vulnerability in its centralized management tool VeloCloud Orchestrator (VCO).

The critical-severity security defect is tracked as CVE-2026-114625 (CVSS score of 9.9) and is described as a remotely exploitable SQL injection.

“VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host,” Arista notes in its advisory .

Successful exploitation could impact the confidentiality, integrity, and availability of both VCO and the data it manages.

“On an affected system, any authenticated user can gain operator privileges and masquerade as a local ‘superuser operator’ user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible,” the company says.

All VCO releases before versions 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected. Arista has already patched the hosted VCO deployments, but urges users to update their on-premises installations as soon as possible.

“This issue was detected by Arista and is known to be actively exploited,” the company says.

Arista notes that VCO deployments are exposed by default, and that attackers need access to the VCO web interface and a valid authenticated session, with the lowest built-in tenant role privileges.

“There is no configuration that can prevent the exposure,” the company notes.

Attacks have been observed originating from two IP addresses, 74.82.197.86 and 38.54.50.151. Administrators should block them, check logs for their presence, and investigate high-request rates, as well as requests with unusual URL-like path components, encoded characters, and references to local or internal services.

“If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible,” Arista notes.

Updating to a fixed VCO release is the recommended remediation action. Until the fixes are deployed, administrators should restrict access to the VCO interface, review recent admin activity, monitor for suspicious access, block outbound ports, and monitor for backdoor daemons and webshells.

CVE-2026-114625 is the third exploited zero-day vulnerability Arista patches in VCO in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September.

Related: Atlassian Patches 75 Flaws in Data Center and Server Products

Related: Signal Vulnerability Lets Malicious Callers Block Hang-Ups

Related: Splunk, SolarWinds Release Fresh Security Updates

Related: Cisco Patches 34 Vulnerabilities Across Multiple Products

Ionut Arghire is an international correspondent for SecurityWeek.

More from Ionut Arghire

Signal Vulnerability Lets Malicious Callers Block Hang-Ups

Splunk, SolarWinds Release Fresh Security Updates

Cisco Patches 34 Vulnerabilities Across Multiple Products

PHP2Shell Exploitation Started Days Before Patches

PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors

Memory Bugs Account for Most of Chrome’s 353 New Security Fixes

Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys

Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor

China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

11 Million Impacted by Capcom Data Breach

Quest Diagnostics Reports Cyber Breach Affecting ‘Certain Patient Records’

LiteLLM Compromised in Fresh Supply Chain Attack

Atlassian Patches 75 Flaws in Data Center and Server Products

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016

Hacker Conversations: Corey Thuen and the Evil Bit

Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform

Flipboard Whatsapp Whatsapp Email