Skip to content
Arista Patches Critical SQL Injection Zero-Day in VeloCloud Orchestrator

Arista Patches Critical SQL Injection Zero-Day in VeloCloud Orchestrator

First seen 22 Oct 2026, 19:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 21:13 UTC
  • •CVE-2026-114625 allows privilege escalation via SQL injection for authenticated users.
  • •Arista has patched affected VCO versions; admins should apply updates immediately.
  • •Monitoring for suspicious activity and blocking known malicious IPs is recommended.

Arista Networks has released security updates for a critical zero-day vulnerability, CVE-2026-114625, affecting the VeloCloud Orchestrator (VCO) used in SD-WAN deployments. This flaw allows authenticated users with basic privileges to escalate their access to operator-level control through a low-complexity SQL injection attack. The vulnerability impacts on-premises VCO versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. Arista has advised administrators to monitor for suspicious activity and block specific malicious IP addresses associated with ongoing attacks. The flaw is rated 9.9 on the CVSS scale, indicating its critical severity. This is the third actively exploited vulnerability reported by Arista this year, highlighting ongoing security challenges for their SD-WAN products.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-06-05
CVE-2026-7473 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-27
CVE-2026-16812 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-22
CVE-2026-93952 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
Arista releases security updates
Arista Networks issued patches for CVE-2026-114625, a critical SQL injection vulnerability in VCO.
BleepingComputer
2026-10-22
Vulnerability disclosed
CVE-2026-114625 was disclosed as a zero-day flaw allowing privilege escalation for authenticated users.
Thehackernews
2026-10-22
Advisory issued
Arista advised users to monitor for malicious IP addresses and review access logs for suspicious activity.
Mezha

More articles in this cluster (4)

Following this threat?

Track Arista Networks and CVE-2026-114625 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 4

Common questions

Which versions of VCO are affected?
On-premises VCO versions 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected.
What should I do if I cannot patch immediately?
Limit access to the VCO web interface to trusted networks and monitor for suspicious activity.
How severe is this vulnerability?
CVE-2026-114625 is rated 9.9 on the CVSS scale, indicating critical severity.