Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day

Summary

Arista patched CVE-2026-114625, a critical SQL injection in on-prem VeloCloud Orchestrator that it says is actively exploited. Affected releases need updates; exploitation requires VCO web access and an authenticated session.

Key points

CVE-2026-114625 is a critical remotely exploitable SQL injection with a CVSS score of 9.9.
Arista says an authenticated user can gain operator privileges and access internal functionality, potentially affecting VCO and managed data.
Releases before 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected; Arista says hosted deployments are patched and urges on-premises users to update.
Arista reports the flaw is actively exploited. It says attacks were observed from 74.82.197.86 and 38.54.50.151.
Arista recommends blocking the observed IPs, reviewing logs and suspicious activity, and preserving relevant evidence if compromise is suspected.
This is the third exploited VCO zero-day Arista has patched in four months, following CVE-2026-16812 and CVE-2026-93952.

Article Details

Vulnerability Types: SQL injection
Severity: Critical (CVSS 9.9)
Affected Versions: VeloCloud Orchestrator (VCO) versions before 5.2.3.18
VeloCloud Orchestrator (VCO) versions before 6.1.3.10
VeloCloud Orchestrator (VCO) versions before 6.4.2.12
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available
Workarounds: Restrict access to the VCO interface until fixes are deployed.
Block the two observed attacker IP addresses.
Block outbound ports and monitor for suspicious access, backdoor daemons, and webshells.

Indicators of compromise

Type	Indicator	Context
IPV4	`38[.]54[.]50[.]151`	IP address from which attacks exploiting the VCO vulnerability were observed.
IPV4	`74[.]82[.]197[.]86`	IP address from which attacks exploiting the VCO vulnerability were observed.