Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day

Arista Networks has released a security update for an actively exploited zero-day vulnerability affecting on-premises VeloCloud Orchestrator (VCO) deployments.

VCO is a web-based management portal that administrators use to configure, monitor, and manage VeloCloud SD-WAN (Software-Defined Wide Area Network) environments and associated edge devices.

CVE-2026-114625 enables privilege escalation

Tracked as CVE-2026-114625, the critical-severity vulnerability could allow an attacker with basic privileges, access to the VCO web interface, and a valid authenticated session to escalate privileges through a low-complexity SQL injection attack. The attack does not require user interaction.

“On-premises VeloCloud Orchestrator (VCO) contains a security issue that could allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation could compromise the confidentiality, integrity, and availability of the Orchestrator and the data it manages,” Arista said.

“On affected systems, an authenticated user can gain operator privileges and impersonate a local ‘superuser operator’ user. This includes accessing functionality that is intended for internal use only and is not intended to be accessed remotely.”

Arista patches hosted VCO deployments

Arista said it has already patched hosted VCO deployments running the following versions:

• Version 5.2.3.18 and later
• Version 6.1.3.10 and later
• Version 6.4.2.12 and later

Administrators should apply the available security update as soon as possible. Until the patch is deployed, Arista recommends monitoring connections from known malicious IP addresses, restricting access to the VCO web interface to the management network, and checking for unusual administrator activity.

Arista shares indicators of compromise

Security teams should review VCO web access logs for suspicious activity, including:

• Requests containing unusual URL-like path components
• Encoded characters
• References to local or internal services
• Unusually high request rates

Arista also warned security teams to block the following IP addresses, which were observed during the ongoing attack:

• 74[.]82[.]197[.]86
• 38[.]54[.]50[.]151

If a breach is suspected, operators should, to the extent operationally possible, preserve VCO web access logs, back-end application logs, system logs, database logs, and associated file system timestamps before remediation.

Arista advises affected customers to contact the Arista Networks Technical Assistance Center (TAC) for additional assistance.

Arista has patched other actively exploited zero-days

Arista has patched three other actively exploited zero-day vulnerabilities this year: CVE-2026-7473, CVE-2026-16812 in May, and CVE-2026-93952 in September. The vulnerabilities affect Extensible Operating System (EOS) and on-premises VeloCloud Orchestrator deployments.

Arista Networks is a Fortune 500 company and one of the largest companies in the United States by revenue, with more than 10,000 customers worldwide.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report