Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months
Arista Networks patches third exploited VeloCloud Orchestrator zero-day in four months.
Run Arista Networks?
Get an email when a reviewed story names Arista Networks, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Arista Networks has released patches for a critical SQL injection zero-day vulnerability (CVE-2026-114625) in its VeloCloud Orchestrator (VCO). This flaw allows authenticated users to gain operator privileges and access internal functionality. This marks the third exploited zero-day in VCO within four months, highlighting a concerning trend for the product.
The lesson from this incident
Full lessonA critical SQL injection vulnerability (CVE-2026-114625) in Arista's VeloCloud Orchestrator allows authenticated users to escalate privileges to operator level, representing the third exploited zero-day in the same product within four months. The repeated exploitation pattern suggests that organizations are failing to prioritize patching for a high-value network orchestration platform, and that the vendor's own secure development lifecycle may need strengthening. SQL injection flaws are well-understood and preventable through input validation and parameterized queries, making their presence in a critical enterprise product particularly concerning. This trend underscores that attackers actively track vulnerable products and chain successive zero-days when they know defenders are slow to respond.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
- cve — CVE-2026-114625
- ip — 74.82.197.86
- ip — 38.54.50.151