Arista Patches Actively Exploited VeloCloud Orchestrator SQL Injection Zero-Day
Active Exploitation · 15 sources · Updated 4h ago · First seen Oct 22, 2026
Arista Networks disclosed active exploitation of CVE-2026-114625, a critical SQL injection vulnerability in VeloCloud Orchestrator (VCO) with a reported CVSS score of 9.9. An attacker with network access and a valid account—even the lowest-privileged Enterprise Read Only role—can escalate to operator privileges and impersonate a local superuser operator. The low-complexity attack requires no user interaction and exposes internal-only functionality, potentially compromising the orchestrator, its host, and managed data. It is the third VCO vulnerability reported as exploited since late July.
Arista has patched Hosted and Dedicated orchestrators and released on-premises fixes in 5.2.3.18, 6.1.3.10, and 6.4.2.12, with later releases also reported to include remediation. Organizations should upgrade affected on-premises deployments, restrict management access to trusted administrative networks, and monitor logs for compromise. Arista identified two IP addresses associated with exploitation and recommended blocking them. Defenders should preserve evidence before remediation and investigate possible existing access: the advisory does not establish that upgrading removes an attacker’s foothold.
