Arista Networks has released security updates for a VeloCloud Orchestrator zero-day that attackers are actively exploiting. The critical vulnerability affects on-premises deployments and allows authenticated users with basic privileges to gain powerful administrative access.
Tracked as CVE-2026-114625, the flaw involves SQL injection through the VeloCloud Orchestrator web interface. Exploitation requires a valid authenticated session but needs no interaction from another user.
Flaw Gives Basic Users Access to Internal Functions
VeloCloud Orchestrator provides a central web portal for configuring and monitoring software-defined wide area networks and their associated edge devices.
However, the vulnerability allows an authenticated attacker to gain operator privileges and impersonate a local superuser operator. Consequently, attackers can reach internal functions that administrators should not be able to access remotely.
Arista warned that successful exploitation could affect the orchestrator host and compromise the confidentiality, integrity and availability of its data.
The company describes the attack as low complexity. Nevertheless, attackers must first have access to the web interface and a valid account session.
Arista Confirms Fixes for Hosted Deployments
Alongside its security updates, Arista said it has already patched hosted VCO deployments running these versions or later within their respective release branches:
- 5.2.3.18
- 6.1.3.10
- 6.4.2.12
Administrators responsible for on-premises installations should apply the relevant security updates. Meanwhile, they should restrict access to the management interface while they arrange deployment.
These temporary restrictions can reduce exposure, but they do not replace the patches for the VeloCloud Orchestrator zero-day.
Administrators Should Restrict Access and Review Activity
Arista recommends limiting access to the VCO web interface to administrative networks. Additionally, security teams should review recent administrator activity for unexpected changes.
Web access logs may also reveal suspicious requests. The company highlighted several warning signs:
- Unusual URL-like components within request paths.
- Encoded characters.
- References to local or internal services.
- Unusually high request rates.
Furthermore, Arista advised organisations to block two IP addresses associated with the ongoing attacks: 74[.]82.197.86 and 38[.]54.50.151.
Security teams should also check for previous connections from those addresses when investigating potential intrusion activity.
Preserve Evidence Before Remediation Where Possible
If administrators suspect a compromise, Arista recommends preserving relevant evidence before remediation where operationally feasible.
That evidence includes web access logs, backend application logs, system logs and database logs. Relevant filesystem timestamps may also help investigators reconstruct suspicious activity.
In addition, affected customers can contact Arista’s Technical Assistance Center for support.
Latest Incident Follows Three Earlier Exploited Flaws
The disclosure follows three other actively exploited zero-day vulnerabilities that Arista patched earlier in 2026.
Those incidents involved CVE-2026-7473 in May, CVE-2026-16812 in July and CVE-2026-93952 in September. Across the three cases, affected products included Arista’s Extensible Operating System and on-premises VeloCloud Orchestrator deployments.
The latest attacks reinforce the need to secure management interfaces and investigate unusual privileged activity alongside patch deployment.
0 responses to “Arista Patches VeloCloud Orchestrator Zero-Day Used in Attacks”