GoKawiilArista patches actively exploited VeloCloud Orchestrator SQL injection flaw
Arista Networks has issued security updates for a critical zero-day, CVE-2026-114625, affecting on-premises VeloCloud Orchestrator deployments. The flaw lets authenticated users with basic privileges exploit a low-complexity SQL injection to escalate to 'superuser operator' access without user interaction, and Arista says it has already patched its own hosted VCO instances on versions 5.2.3.18+, 6.1.3.10+, and 6.4.2.12+.
GoKawiil's interpretation of the reporting above, not reported fact.
The bug is already being exploited in the wild, so organizations running affected on-prem VCO versions face immediate risk to SD-WAN management infrastructure that controls network configuration and edge devices. Arista's mitigation advice—blocking specific malicious IPs, restricting interface access, and auditing logs—suggests attackers are actively probing for exposed orchestrators before patches are applied.
- CVE-2026-114625 is a critical SQL injection flaw in VeloCloud Orchestrator on-prem deployments already under active exploitation.
- Attackers with low-level authenticated access can escalate to superuser operator privileges without needing user interaction.
- Arista has patched hosted VCO and released fixes for on-prem versions, while urging admins to block two specific malicious IPs and monitor logs.
Source: bleepingcomputer.com, 2026-10-22
Published there as: “Arista patches new VeloCloud Orchestrator zero-day exploited in attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.