Arista patches actively exploited zero-day in VeloCloud Orchestrator

Critical SQL injection flaw allows privilege escalation; patches available for hosted deployments

By LineZotpaper

Published22 October 2026

Read Time2 min

Arista Networks has released security updates to address an actively exploited zero-day vulnerability in its VeloCloud Orchestrator (VCO) on-premises deployments, the company confirmed. The critical-severity flaw, tracked as CVE-2026-114625, allows authenticated attackers to escalate privileges via SQL injection and access internal functionality.

The vulnerability affects VCO's on-premises management portal used to configure and monitor SD-WAN networks and edge devices. An attacker with basic privileges, access to the VCO web interface, and a valid authenticated session can exploit the flaw to gain operator privileges and masquerade as a local superuser operator. This could compromise the confidentiality, integrity, and availability of the orchestrator and managed data.

Arista said it has patched hosted VCO deployments running version 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later. The company advised administrators to monitor for connections from known malicious IP addresses, restrict access to the VCO web interface to administrative networks, and review recent administrator activity for unusual changes. Specific IP addresses 74.82.197.86 and 38.54.50.151 have been observed in ongoing attacks and should be blocked.

If compromise is suspected, Arista recommended preserving logs and contacting its Technical Assistance Center. This marks the fourth actively exploited zero-day patched by Arista this year, following flaws in May, July, and September affecting its Extensible Operating System and on-premises VeloCloud Orchestrator.

Analysis

Why This Matters

Organizations using VeloCloud Orchestrator on-premises are at immediate risk of compromise if unpatched.
The vulnerability is already being exploited in the wild, making timely patching critical.
Repeated zero-days this year may signal broader security challenges in SD-WAN management software.

Background

VeloCloud Orchestrator is a web-based management platform for SD-WAN deployments, allowing administrators to configure and monitor network edge devices. Zero-day vulnerabilities are flaws that are exploited before the vendor releases a fix. Arista Networks, a Fortune 500 company with over 10,000 customers, has patched three other actively exploited zero-days in 2026, indicating persistent targeting of its products.

Key Perspectives

Arista Networks: The company has released patches and detailed workarounds to mitigate risks. It is cooperating with affected customers and has provided indicators of compromise. Affected customers: Organizations must urgently apply patches to hosted deployments and implement recommended monitoring and access restrictions. The repeated zero-days may prompt some to reconsider reliance on the platform. Security researchers and attackers: Attackers are actively exploiting this vulnerability, likely seeking to gain persistent access to SD-WAN management layers.

What to Watch

Whether patches for on-premises deployments (beyond hosted versions) are released soon.
Reports of compromise from customers who have not yet patched.
Any further disclosures from Arista about the root cause or additional vulnerabilities.
Indications that the IP addresses observed in attacks are linked to broader campaigns.

Sources

Arista patches new VeloCloud Orchestrator zero-day exploited in attacks · BleepingComputer

Checked

11 claims in this story checked against 1 source: 8 supported.

Show each claim

SupportedArista patched an actively exploited VeloCloud Orchestrator zero-day.BleepingComputer: “Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments.”
SupportedThe flaw is critical-severity and uses SQL injection to enable privilege escalation.BleepingComputer: “this critical-severity flaw can allow attackers with basic privileges, access to the VCO web interface, and a valid authenticated session to escalate privileges through low-complexity SQL injection attacks”
SupportedPatches are available for hosted VCO deployments.BleepingComputer: “The company said it has already patched hosted VCO deployments running version 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later.”
Partly supportedArista confirmed that the zero-day was actively exploited.BleepingComputer: “Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments.”
SupportedThe flaw affects VCO on-premises deployments.BleepingComputer: “Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments.”
SupportedAn attacker with basic privileges, web-interface access and an authenticated session can exploit the flaw to gain operator privileges and masquerade as a local superuser operator.BleepingComputer: “On an affected system, any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user.”
SupportedSuccessful exploitation could compromise the orchestrator and managed data's confidentiality, integrity and availability.BleepingComputer: “Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator,”
Partly supportedArista advised administrators to monitor for malicious-IP connections, restrict web-interface access to administrative networks and review administrator activity.BleepingComputer: “Until the patches are deployed, Arista advised admins to monitor for connections from known malicious IP addresses, restrict access to the VCO web interface to administrative networks, and review recent administrator activity for unusual changes.”
SupportedThe IP addresses 74.82.197.86 and 38.54.50.151 were observed in ongoing attacks and should be blocked.BleepingComputer: “The company also warned security teams to block the 74[.]82.197.86 and 38[.]54.50.151 IP addresses, which have been observed during ongoing attacks.”
Partly supportedIf compromise is suspected, Arista recommended preserving logs and contacting its Technical Assistance Center.BleepingComputer: “If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible,”
SupportedThis is Arista's fourth actively exploited zero-day patched this year, after flaws in May, July and September affecting EOS and on-premises VCO.BleepingComputer: “This year, Arista has patched three other actively exploited zero-day flaws ( CVE-2026-7473 in May, CVE-2026-16812 in July, and CVE-2026-93952 in September) affecting Extensible Operating System (EOS) and on-premises VeloCloud Orchestrator deployments.”