Arista patches actively exploited VeloCloud zero-day

Arista Networks has released security updates to patch a zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments. The flaw, tracked as CVE-2026-114625, is rated 9.9 on the CVSS scale and allows attackers with basic privileges to escalate them through SQL injection attacks. Arista stated that successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and its managed data.

On affected systems, any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user. To exploit the flaw, an attacker needs network access to the orchestrator's web interface and a valid login with at least the Enterprise Read Only role. Arista shared two IP addresses geolocated to Japan as responsible for driving the activity related to this vulnerability. The company has not attributed the activity to a particular threat actor or provided technical details on how the vulnerability is being exploited.

Arista has already patched hosted VCO deployments running version 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later. The fix for on-premises orchestrators is available in the same versions. Arista advised administrators to monitor for connections from known malicious IP addresses until patches are deployed. This is the third exploited flaw in VCO since late July and the first of the three that requires a login.

CISA added the vulnerability to its Known Exploited Vulnerabilities list on Friday. Arista issued an advisory on October 22 warning of the critical SQL injection zero-day. The company bought the VeloCloud SD-WAN product line from Broadcom, announcing the deal in July 2025. Arista has patched three other actively exploited zero-day flaws affecting Extensible Operating System and on-premises VeloCloud Orchestrator deployments this year.