Arista patches new VeloCloud Orchestrator zero-day exploited in attacks

CVE-2026-114625 is a critical zero-day SQL injection vulnerability in Arista's VeloCloud Orchestrator On-Prem deployments. It allows any authenticated user with basic privileges to escalate to operator privileges and masquerade as a superuser operator. Exploitation does not require user interaction and can expose internal functionality intended only for local use. Arista has released patches for hosted VCO versions 5.2.3.18+, 6.1.3.10+, and 6.4.2.12+. The company advises administrators to restrict web interface access to trusted networks, monitor logs for suspicious activity, and block IP addresses 74.82.197.86 and 38.54.50.151, which have been observed in active exploitation attempts. If compromise is suspected, preserving relevant logs before remediation is recommended.

Successful exploitation allows attackers with basic authenticated access to escalate privileges to operator level, gaining access to internal and privileged functionality not intended for remote access. This can compromise the confidentiality, integrity, and availability of the VeloCloud Orchestrator and the data it manages. The vulnerability is actively exploited in the wild, increasing risk to affected organizations.

Arista has released official patches for hosted VCO deployments running versions 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later. Administrators should apply these updates promptly. Until patched, restrict access to the VCO web interface to administrative networks only, monitor VCO web access logs for suspicious activity such as unusual URL paths or high request rates, and block the malicious IP addresses 74.82.197.86 and 38.54.50.151. If compromise is suspected, preserve all relevant logs and timestamps before remediation and contact Arista Networks Technical Assistance Center (TAC) for support.