Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months

Networking solutions provider Arista Networks on Thursday rolled out patches for an exploited zero-day vulnerability in its centralized management tool VeloCloud Orchestrator (VCO).

The critical-severity security defect is tracked as CVE-2026-114625 (CVSS score of 9.9) and is described as a remotely exploitable SQL injection.

“VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host,” Arista notes in its advisory .

Successful exploitation could impact the confidentiality, integrity, and availability of both VCO and the data it manages.

“On an affected system, any authenticated user can gain operator privileges and masquerade as a local ‘superuser operator’ user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible,” the company says.

All VCO releases before versions 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected. Arista has already patched the hosted VCO deployments, but urges users to update their on-premises installations as soon as possible.

“This issue was detected by Arista and is known to be actively exploited,” the company says.

Arista notes that VCO deployments are exposed by default, and that attackers need access to the VCO web interface and a valid authenticated session, with the lowest built-in tenant role privileges.

“There is no configuration that can prevent the exposure,” the company notes.

Attacks have been observed originating from two IP addresses, 74.82.197.86 and 38.54.50.151. Administrators should block them, check logs for their presence, and investigate high-request rates, as well as requests with unusual URL-like path components, encoded characters, and references to local or internal services.

“If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible,” Arista notes.

Updating to a fixed VCO release is the recommended remediation action. Until the fixes are deployed, administrators should restrict access to the VCO interface, review recent admin activity, monitor for suspicious access, block outbound ports, and monitor for backdoor daemons and webshells.

CVE-2026-114625 is the third exploited zero-day vulnerability Arista patches in VCO in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September.

Related: Atlassian Patches 75 Flaws in Data Center and Server Products

Related: Signal Vulnerability Lets Malicious Callers Block Hang-Ups

Related: Splunk, SolarWinds Release Fresh Security Updates

Related: Cisco Patches 34 Vulnerabilities Across Multiple Products

Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.

Atlassian Patches 75 Flaws in Data Center and Server Products

Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components.

Signal Vulnerability Lets Malicious Callers Block Hang-Ups

Affecting the open source calling library RingRTC, the bug prevented calls from ending properly.

Splunk, SolarWinds Release Fresh Security Updates

Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information.

Cisco Patches 34 Vulnerabilities Across Multiple Products

Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks.

PHP2Shell Exploitation Started Days Before Patches

Initial attempts were observed on October 17, and mass activity began shortly after patches were released.

Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU

Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches.

PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors

Several cybersecurity companies saw exploitation attempts of CVE-2026-109618 and CVE-2026-109619 before PHP released the patches.