Fast Facts
- Actively exploited zero-day: CVE-2026-114625 is a critical SQL injection flaw in VeloCloud Orchestrator (CVSS 9.9).
- Low-privilege access can become full control: A valid read-only customer login can let attackers gain local superuser privileges.
- Patch affected on-prem systems now: Upgrade to VCO 5.2.3.18, 6.1.3.10, or 6.4.2.12, as applicable; hosted and dedicated systems are patched.
- Hunt and contain: Restrict VCO access, check logs for suspicious activity and the reported IPs, and preserve evidence if compromise is suspected.
Arista Warns of Exploited VeloCloud Zero-Day
A Low-Level Login Can Lead to Full Control
Arista says attackers are exploiting a critical SQL injection flaw in VeloCloud Orchestrator, the system companies use to manage VeloCloud SD-WAN networks. The flaw, tracked as CVE-2026-114625, has a severity score of 9.9 out of 10.
An attacker needs network access to the orchestrator’s web interface and a valid account. Even a read-only customer account can provide a path to operator-level control. In simple terms, the flaw can let an attacker manipulate database instructions and take over the management system.
That access could expose, alter, or disrupt the system and the data it manages. However, Arista has not said which systems attackers hit, when the attacks began, or what they did afterward. The company also has not confirmed whether attackers can use this flaw to reach connected Edge devices.
Updates and Checks for Customers
On-premises customers should upgrade to VCO 5.2.3.18, 6.1.3.10, or 6.4.2.12, depending on their release train. Arista says it has already fixed the flaw in its Hosted and Dedicated services. VeloCloud Gateway and Edge products are not affected.
Until they upgrade, customers should restrict web access to trusted administrative networks, review administrator activity, and watch for unusual connections or outbound traffic. Arista also advises checking logs for activity linked to two reported attack addresses: 74.82.197[.]86 and 38.54.50[.]151.
The alert is the third report since late July of attackers exploiting a VeloCloud Orchestrator flaw. Unlike the two earlier flaws, this one requires a login—but even a basic account can carry serious risk. For organizations that rely on remote network management, prompt updates and careful account oversight can help keep essential services running.
Expand Your Tech Knowledge
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Access comprehensive resources on technology by visiting Wikipedia.
CyberAttacks-V1
