Published on October 25, 2026
Attackers Exploit Third Arista VCO Zero-Day in Four Months
Severity
Critical
Detail
Arista Networks has released security updates to address a critical zero-day vulnerability affecting its VeloCloud Orchestrator (VCO), a centralized management platform used to manage SD-WAN deployments. The vulnerability, tracked as CVE-2026-114625, is a remotely exploitable SQL injection flaw that has been confirmed to be actively exploited in the wild.
According to Arista, vulnerability could allow an authenticated attacker to access privileged internal functionality and impact the underlying VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of both the VCO platform and the data it manages.
The flaw can be exploited by a user possessing a valid authenticated session, including accounts with the lowest built-in tenant role privileges. An attacker could leverage the vulnerability to gain operator-level privileges and masquerade as a local “superuser operator,” providing access to administrative functions and internal capabilities that are not intended to be remotely accessible.
Arista has indicated that the vulnerability affects on-premises VCO deployments and that hosted VCO environments have already been remediated. The company further stated that there is no configuration workaround available to eliminate exposure, as VCO deployments are exposed by default and require patching to fully address the issue.
The vulnerability is notable as the third actively exploited VeloCloud Orchestrator zero-day disclosed within a four-month period, highlighting continued targeting of SD-WAN management infrastructure by threat actors.
Arista observed exploitation attempts originating from the following IP addresses:
- 74.82.197.86
- 38.54.50.151
Administrators are advised to review logs for connections from these addresses and investigate suspicious requests, high request rates, unusual URL path components, encoded characters, and references to local or internal services.
| CVE ID | Summary | CVSS Score |
| CVE-2026-114625 | SQL injection vulnerability in Arista VeloCloud Orchestrator allowing authenticated attackers to gain operator privileges, access privileged internal functionality and potentially impact the host system. | 9.9 (Critical) |
Affected Products
The following products and versions have been identified as affected:
| Product | Affected Versions | Fixed Versions |
| Arista VeloCloud Orchestrator (VCO) On-Premises | All releases prior to 5.2.3.18 | 5.2.3.18 and later |
| Arista VeloCloud Orchestrator (VCO) On-Premises | All releases prior to 6.1.3.10 | 6.1.3.10 and later |
| Arista VeloCloud Orchestrator (VCO) On-Premises | All releases prior to 6.4.2.12 | 6.4.2.12 and later |
Recommendation
Organizations using Arista VeloCloud Orchestrator should:
- Immediately upgrade affected VCO deployments to versions 5.2.3.18, 6.1.3.10, 6.4.2.12, or later.
- Restrict access to the VCO web management interface to trusted administrative networks where possible.
- Review recent administrative and operator account activity for signs of unauthorized access.
- Monitor VCO access logs for requests originating from the identified malicious IP addresses.
- Investigate abnormal request patterns, URL-encoded payloads, unusual path traversal attempts, and references to internal services.
- Block outbound connections to suspicious destinations pending investigation.
Source
https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months
https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199