Attackers are actively exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator, which is the central management system for VeloCloud SD-WAN networks, because the company confirmed the attacks in an advisory on October 22. The flaw allows anyone who can log in to the orchestrator, even with a low-privilege read-only customer account, to gain operator privileges, which is the top level of control over the system.
The vulnerability is tracked as CVE-2026-114625, and it carries a critical CVSS score of 9.9.
For on-premises orchestrators, the fix is available in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12, while Hosted and Dedicated orchestrators have already been patched by Arista.
Why This Zero-Day Is Exceptionally Dangerous
The most concerning aspect of this Arista VeloCloud vulnerability is the low barrier to entry for an attacker. They only need network access to the orchestrator's web interface and a valid login, and the minimum role required is Enterprise Read Only, which is the lowest built-in role for customer users.
VCO is exposed by default, and no VCO setting prevents this exposure. In VCO, operators create the customer and partner accounts, and each partner can manage a group of customers. The flaw allows an attacker to act as a local superuser, which is a role with full access, and it may also allow an attacker to affect the VCO host itself to expose, modify, or disrupt the orchestrator and the data it manages.
This is the third flaw in VCO since late July that Arista has reported as exploited, but it is the first of the three that requires a login, because neither the July flaw (CVE-2026-16812) nor the September flaw (CVE-2026-93952) needed one.
Affected and Fixed Releases
Orchestrators running the releases that fixed the VCO flaws exploited in July and September are still affected by this new flaw, because those releases are older than the new fixes.
|
Release train |
Affected by CVE-2026-114625 |
Fixed in |
CVE-2026-93952 (September) fixed in |
|
5.2 |
Before 5.2.3.18 |
5.2.3.18 and later |
5.2.3.16 |
|
6.1 |
Before 6.1.3.10 |
6.1.3.10 and later |
No fix listed |
|
6.4 |
Before 6.4.2.12 |
6.4.2.12 and later |
6.4.2.8 |
VeloCloud Gateway and VeloCloud Edge are not affected, and the 7.0 release train is not on the list. Arista says any release not on the list is not vulnerable, but they have not checked releases that have reached end of support. Customers on an unsupported release train can contact Arista's Technical Assistance Center about upgrade options.
How to Detect an Active Compromise
Because Arista has not disclosed exactly when the attacks began or which orchestrators were hit, defenders must assume their perimeter is being probed. Two IP addresses have been observed carrying out the attacks, so administrators should block them and check logs for any sign of them:
- 74.82.197[.]86
- 38.54.50[.]151
You should also check VCO web access logs for requests with unusual URL-like path components, encoded characters, references to local or internal services, or high request rates.
If you suspect a compromise, save evidence before fixing anything, where possible. That means preserving the VCO web access logs, backend application logs, system and database logs, along with the relevant file-system timestamps.
Mitigation Steps for Unpatched Systems
Until the fixed release is installed, Arista recommends several interim steps to reduce your attack surface:
- Limit access: Restrict access to the VCO web interface to trusted administrative networks only.
- Monitor for known threats: Watch the VCO for connections from the known malicious IP addresses.
- Watch outbound traffic: Look for unexpected outbound network activity from the VCO host.
- Block unnecessary ports: Consider blocking outbound ports that normal operation does not need.
- Hunt for persistence: Watch for backdoor daemons and webshells.
- Review admin activity: Check recent administrator activity for unexpected changes.
Regarding the July and September flaws, Arista warned that a compromised orchestrator could also grant attackers access to VeloCloud Edge devices, though the advisory does not say whether upgrading removes access that an attacker has already gained.
FAQ
What is CVE-2026-114625?
It is a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO) that allows an authenticated user with even a read-only account to gain full operator privileges.
Does this affect VeloCloud Edge or Gateway?
No, only the VeloCloud Orchestrator is affected. VeloCloud Gateway and VeloCloud Edge are not vulnerable, and the 7.0 release train is also unaffected.
Which versions fix the flaw?
For on-premises orchestrators, the fix is in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12. Hosted and Dedicated orchestrators have already been patched by Arista.
How is the attacker getting in?
An attacker only needs network access to the orchestrator's web interface and a valid login. The minimum role required is Enterprise Read Only.
What should I do if I suspect a compromise?
Keep all logs, including VCO web access logs, backend application, system, and database logs, and also file system timestamps, before taking any remedial action. Block the known malicious IP addresses and look for any suspicious URL paths within the log file.
