Arista patches VeloCloud Orchestrator SQL injection zero-day, CVE-2026-114625, that it says is being exploited

TLDR

• Arista says CVE-2026-114625, a CVSS 9.9 SQL injection in VeloCloud Orchestrator on-prem, is being actively exploited.¹
• Any authenticated user, even with the lowest Enterprise Read Only role, can gain operator privileges.¹
• Fixes are in VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12; hosted and dedicated instances are already patched.¹

Arista Networks said in a security advisory on 22 October that VeloCloud Orchestrator (VCO) on-prem has a flaw, tracked as CVE-2026-114625 and rated 9.9 on the CVSS 3.1 scale, that lets any authenticated user gain operator privileges and masquerade as a local "superuser operator".¹ The advisory classes it as an SQL injection (CWE-89), says it was detected by Arista and is known to be actively exploited, and warns that a successful attack may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages.¹ BleepingComputer describes it as a low-complexity attack needing no user interaction.²

An attacker needs network access to the VCO web interface and a valid session, and the minimum role is Enterprise Read Only, the lowest built-in tenant role.¹ Arista says VCO is exposed by default and no configuration prevents the exposure.¹ Affected releases are 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12, and Arista has not assessed end-of-support versions.¹ Hosted and dedicated VCO deployments were affected and have already been patched, and VeloCloud Gateway and Edge are not affected.¹

Until patches are applied, Arista advises restricting the web interface to trusted administrative networks, watching for backdoor daemons, webshells and unexpected outbound traffic, and blocking two source addresses seen in the attacks, 74.82.197.86 and 38.54.50.151.¹ If compromise is suspected it advises preserving web access, application, system and database logs and file-system timestamps before remediation where feasible.¹

The Hacker News notes the advisory does not say when the attacks began, which orchestrators were hit or what attackers did afterwards.³ It describes this as the third VCO flaw Arista has reported as exploited since late July, and the first to need a login, and says orchestrators running the releases that fixed the July and September flaws remain affected because those releases are older than the new fixes.³ It also says the advisory does not state whether the Edge-device access risk Arista flagged for the earlier flaws applies here.³ BleepingComputer adds that Arista has patched three other actively exploited zero-days this year, in May, July and September, affecting EOS and on-prem VeloCloud Orchestrator.²

Why it matters: VCO is the central management system for VeloCloud SD-WAN networks, and a read-only login is enough to reach superuser control, so on-prem operators should upgrade and review logs for signs of compromise rather than patch alone.¹³