Arista Networks has patched an actively exploited zero-day in the on-premises version of VeloCloud Orchestrator (VCO), the web portal administrators use to configure and monitor VeloCloud SD-WAN networks and their edge devices. The flaw, CVE-2026-114625, is a SQL injection rated CVSS 9.9 (v3.1) in Arista’s advisory. Arista says it detected the issue itself and that it is known to be actively exploited.
According to Arista, any authenticated user on an affected system can gain operator privileges and masquerade as a local “superuser operator”, reaching functionality meant for internal use only. Arista warns that successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. BleepingComputer describes the attack as needing only basic privileges and a valid authenticated session, with no user interaction. Hosted, including Dedicated, VCO deployments were affected and have already been patched.
This is the latest in a run of VeloCloud Orchestrator zero-days. BleepingComputer counts three other exploited Arista flaws patched this year (CVE-2026-7473, CVE-2026-16812 and CVE-2026-93952); we covered the September certificate-based flaw and an earlier orchestrator zero-day in July.
How to check if you’re affected
Affected versions are on-premises VeloCloud Orchestrator releases older than the fixed builds in Arista’s advisory:
- VCO 5.2.x releases prior to 5.2.3.18
- VCO 6.1.x releases prior to 6.1.3.10
- VCO 6.4.x releases prior to 6.4.2.12
Arista says that if your release is not on that list your deployment is not vulnerable, but it also notes that end-of-support software versions have not been assessed. The advisory lists Arista’s EOS-based switches, CloudVision and the VeloCloud Gateway as not affected products.
The fix is to upgrade to 5.2.3.18 or later, 6.1.3.10 or later, or 6.4.2.12 or later. Until you can, BleepingComputer reports that Arista advises restricting access to the VCO web interface to administrative networks, reviewing recent administrator activity, and checking VCO web access logs for unusual URL-like path components, encoded characters, references to local or internal services, and high request rates. BleepingComputer also reports that Arista asks teams to block 74[.]82.197.86 and 38[.]54.50.151, which were seen in the attacks.
If you suspect compromise, BleepingComputer says Arista recommends preserving VCO web access logs, backend application logs, system logs, database logs and file-system timestamps before remediation where feasible, and contacting the Arista Technical Assistance Center.