Arista patches actively exploited VeloCloud Orchestrator zero-day
Summary
Arista released updates for an actively exploited critical SQL injection flaw in on-prem VeloCloud Orchestrator. Attackers with an authenticated account can gain operator privileges; Arista also recommends access restrictions, log review, and blocking observed IPs.
Key points
- CVE-2026-114625 is a critical-severity SQL injection flaw in VeloCloud Orchestrator (VCO) On-Prem deployments and is being actively exploited.
- An attacker needs basic privileges, access to the VCO web interface, and a valid authenticated session; exploitation requires no user interaction.
- Successful exploitation can grant operator privileges, including the ability to masquerade as a local superuser operator and access internal functionality.
- Arista released security updates; the company said hosted deployments on versions 5.2.3.18, 6.1.3.10, and 6.4.2.12 or later have already been patched.
- Until patches are deployed, Arista advised restricting web access to administrative networks, reviewing administrator activity and web access logs, and blocking 74[.]82.197.86 and 38[.]54.50.151.
- If compromise is suspected, Arista advised preserving web, application, system, and database logs and relevant file-system timestamps before remediation where feasible.
Article Details
- Vulnerability Types
- SQL injection
- Privilege escalation
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict access to the VCO web interface to administrative networks.
- Block 74[.]82.197.86 and 38[.]54.50.151.
- Review VCO web access logs and recent administrator activity for suspicious activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 38[.]54[.]50[.]151 | IP address observed during ongoing attacks; Arista advised customers to block it. |
| IPV4 | 74[.]82[.]197[.]86 | IP address observed during ongoing attacks; Arista advised customers to block it. |