Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks

The vulnerability, tracked as CVE-2026-114625, is rated 9.9 on the CVSS scale and affects VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks. According to Arista's advisory published on October 22, the flaw allows anyone with login access to the orchestrator, including those with read-only customer accounts, to gain operator privileges—the highest level of control.

For on-premises orchestrators, the fix is available in VCO versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. Hosted and Dedicated orchestrators have already been patched. Notably, orchestrators running the releases that fixed previous VCO flaws in July and September remain vulnerable because those fixes are older than the current patches.

Exploitation Details

To exploit this vulnerability, an attacker needs network access to the orchestrator's web interface and a valid login with at least the Enterprise Read Only role—the lowest built-in role for customer users. By default, VCO is exposed without settings to prevent this access. The flaw allows an attacker to act as a local superuser with full access, potentially affecting the VCO host itself and exposing, modifying, or disrupting the orchestrator and its data.

Mitigation Steps

Arista recommends several temporary measures for organizations that cannot immediately upgrade. These include limiting access to trusted administrative networks, monitoring for connections from known malicious IP addresses, watching for unexpected outbound activity, blocking unnecessary outbound ports, and checking for backdoor daemons and webshells.

The company has identified two IP addresses associated with attacks: 74.82.197[.]86 and 38.54.50[.]151. Organizations should block these addresses and check logs for unusual requests, encoded characters, references to internal services, or high request rates. If a compromise is suspected, evidence should be preserved before applying fixes, including web access logs, application logs, system logs, database logs, and file-system timestamps.

Affected Versions

The vulnerability affects specific release trains of VCO, with fixes available for versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. VeloCloud Gateway and VeloCloud Edge devices are not affected. Arista notes that the 7.0 release train is not vulnerable, and any release not listed in their advisory should be considered safe. Customers on unsupported release trains should contact Arista's Technical Assistance Center for upgrade options.