What happened
Arista Networks has patched an actively exploited zero-day in VeloCloud Orchestrator (VCO) on-prem, the web portal used to configure and manage VeloCloud SD-WANs and edge devices. The flaw is tracked as CVE-2026-114625 and carries a CVSS score of 9.9.
It is a remotely exploitable SQL injection. On an affected system, any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user. That includes access to functionality meant only for internal use and not intended to be remotely accessible. Successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and all the data it manages, and can impact the VCO host itself.
The attack is low complexity and needs no user interaction. An attacker needs access to the VCO web interface and a valid authenticated session with the lowest built-in tenant role. Arista says VCO deployments are exposed by default and that there is no configuration that can prevent the exposure.
Arista states the issue was detected by Arista and is known to be actively exploited. This is the third exploited VCO zero-day in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September.
Timeline
- Jul 2026: CVE-2026-16812 patched, actively exploited.
- Sep 2026: CVE-2026-93952 patched, actively exploited.
- 22 Oct 2026: Arista releases the patch for CVE-2026-114625; hosted VCO deployments already patched by Arista.
- 22 Oct 2026: Active exploitation confirmed, two attacker IPs observed.
Am I affected?
You are affected if you run VeloCloud Orchestrator on-prem on any release before the fixed versions. All VCO releases before 5.2.3.18, 6.1.3.10 and 6.4.2.12 are affected.
Hosted VCO deployments have already been patched by Arista to 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later, so no action is needed there.
Check your running version in the VCO UI (Help then About). Remember that even low-privilege tenant accounts can be used, so anyone with a valid login to the web interface is a potential entry point.
What to do now
- Update on-prem VCO to a fixed release: 5.2.3.18, 6.1.3.10 or 6.4.2.12, matching your current branch. This is the recommended remediation.
- Block the two attacker IPs seen in live attacks: 74.82.197.86 and 38.54.50.151.
- Restrict access to the VCO web interface to administrative networks only until you have patched.
- Block outbound ports and monitor for backdoor daemons and webshells.
- Review recent administrator activity for unusual changes, and monitor for suspicious access.
- If you suspect compromise, preserve VCO web access logs, backend application logs, system logs, database logs and relevant file-system timestamps before remediation where operationally feasible, then contact the Arista TAC.
How to hunt
- Search VCO web access logs for connections from 74.82.197.86 and 38.54.50.151.
- Look for high request rates against the VCO web interface.
- Look for requests with unusual URL-like path components, encoded characters, and references to local or internal services, which fit the SQL injection pattern.
- Review admin and operator activity for accounts that suddenly gained superuser operator access or performed changes that do not match normal operations.
- Watch the VCO host for new or unexpected daemons and webshells, and for unexpected outbound connections.
What does not help
Hardening the configuration alone will not protect you. Arista states that VCO is exposed by default and there is no configuration that can prevent the exposure. Restricting the web interface and blocking the known IPs buy time, but they are not a fix. Only updating to a fixed VCO release removes the vulnerability.
Sources
- Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months, SecurityWeek, 23 Oct
- Arista patches new VeloCloud Orchestrator zero-day exploited in attacks, BleepingComputer, 22 Oct
- Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks, The Hacker News, 22 Oct
