Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months

The vulnerability CVE-2026-114625 is a remotely exploitable SQL injection in Arista Networks' VeloCloud Orchestrator on-premises management tool. It allows any authenticated user, even with minimal tenant privileges, to gain operator privileges and masquerade as a superuser operator. This grants access to privileged internal functions not intended for remote access, impacting confidentiality, integrity, and availability of VCO and managed data. The flaw affects all VCO releases before versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. Arista has released patches for these versions and has already patched hosted cloud deployments. The vulnerability is actively exploited in the wild, with attacks traced to specific IP addresses. Due to default exposure of VCO interfaces and lack of configuration to prevent exposure, administrators must apply patches and implement access restrictions.

Successful exploitation allows attackers with authenticated access to escalate privileges to operator level, gaining control over internal VCO functionality and potentially compromising the confidentiality, integrity, and availability of the VCO system and its managed data. This could lead to unauthorized administrative actions and system manipulation.

Arista Networks has released official patches for on-premises VCO versions 5.2.3.18, 6.1.3.10, and 6.4.2.12 that fix this vulnerability. Hosted VCO deployments have already been patched by Arista. Administrators should update on-premises installations immediately. Until patched, restrict access to the VCO web interface, monitor for suspicious activity including unusual URL requests and high request rates, block known malicious IP addresses (74.82.197.86 and 38.54.50.151), review recent administrative actions, and investigate for signs of compromise such as backdoors or webshells. Preserve relevant logs and timestamps if compromise is suspected.