Update Arista VeloCloud Orchestrator to Stop Active Zero-Day Exploits
Attackers are using a critical SQL injection flaw in Arista’s VCO to gain full administrative control. Small-business owners must apply the latest security updates immediately.
Key points
- Arista Networks released patches for an actively exploited zero-day vulnerability in VeloCloud Orchestrator On-Prem deployments.
- The flaw, tracked as CVE-2026-114625, allows low-privilege users to escalate to superuser status via SQL injection.
- Attackers need only a valid login and network access to the web interface to exploit this critical severity issue.
Arista Networks has issued urgent security updates to address a zero-day vulnerability in its VeloCloud Orchestrator (VCO) On-Prem software. According to BleepingComputer, the flaw is being actively exploited in the wild. The vulnerability allows attackers with basic privileges to escalate their access to full operator control, compromising the entire management portal and the data it governs.
This critical-severity issue, identified as CVE-2026-114625, enables remote attackers to access privileged internal functionality without requiring user interaction. Arista stated that successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator. Attackers can masquerade as a local superuser, gaining access to features intended only for internal use. This includes the ability to modify or disrupt the orchestrator host itself.
Context on the Attack
The vulnerability affects the central management system for VeloCloud SD-WAN networks. The Hacker News reported that Arista announced the advisory on October 22. This is the third exploited flaw in VCO since late July, but it is the first to require an authenticated session. Previous vulnerabilities in July and September did not need logins. Arista acquired the VeloCloud product line from Broadcom in July 2025, following its earlier identity as VMware SD-WAN.
Affected Versions and Scope
The flaw impacts specific release trains of the On-Prem orchestrator. Hosted and Dedicated orchestrators running version 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later have already been patched by Arista. For On-Prem users, the fixes are available in those same versions. Releases not listed are not vulnerable. VeloCloud Gateway and VeloCloud Edge devices are unaffected by this specific issue. Unsupported releases have not been checked for this flaw.
What to watch
Arista advises administrators to monitor for connections from known malicious IP addresses until patches are deployed. The company warned teams to block specific IP addresses observed during ongoing attacks. Admins should restrict access to the VCO web interface to administrative networks only. Review recent administrator activity for unusual changes and inspect web access logs for suspicious requests. If compromise is suspected, preserve all logs and file-system timestamps before remediation.
What made it possible
This incident highlights the risk of inadequate input validation in web-based management portals. When applications process user-supplied data without proper sanitization, attackers can inject malicious code that alters database queries. This technique often serves as a privilege escalation vector, allowing low-level accounts to bypass access controls. Teams usually face this challenge when legacy systems lack modern security frameworks. Check whether your infrastructure allows unfiltered queries from authenticated users. Ensure that role-based permissions are strictly enforced at the database level to limit damage from such injection attempts.
Background: Privilege escalation vulnerabilities
Remove local administrator rights from daily users and enforce strict application whitelisting. These two steps block the majority of local privilege escalation attempts. Disable unused services and update dependencies to close known pathways that attackers use to gain higher system access.
Read the full guide: Stop Privilege Escalation: 5 Actions to Block Local Attacks
What to do and how to stay safe: Arista Networks
- Apply the latest security updates to all On-Prem VeloCloud Orchestrator instances immediately.
- Restrict network access to the VCO web interface to trusted administrative subnets only.
- Monitor web access logs for unusual URL patterns or high request rates from unexpected sources.
- Preserve system and database logs if you suspect a breach before performing remediation steps.
Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability affect hosted VeloCloud Orchestrator deployments?
No, Arista has already patched hosted and dedicated orchestrators running version 5.2.3.18 or later.
What is the minimum privilege level required to exploit this flaw?
An attacker needs a valid login with the Enterprise Read Only role, the lowest built-in customer role.
Are VeloCloud Gateway or Edge devices vulnerable to CVE-2026-114625?
No, Arista confirmed that VeloCloud Gateway and VeloCloud Edge devices are not affected by this vulnerability.
