Overview
- On October 22 Arista disclosed CVE-2026-114625, a critical SQL injection in VeloCloud Orchestrator that is being actively exploited to let authenticated users elevate to operator or superuser roles.
- The flaw requires network access to the VCO web interface and a valid login, with the lowest built-in customer role, Enterprise Read Only, sufficient to be abused.
- Arista said Hosted and Dedicated orchestrators are patched and issued on‑prem fixes in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12 and advised customers on upgrade and TAC support paths.
- As immediate steps Arista and the community tell operators to restrict VCO web access to trusted admin networks, block the two IPs seen in attacks (74.82.197.86 and 38.54.50.151), and hunt logs for unusual URL paths, encoded payloads, outbound traffic and backdoor artifacts.
- This is the third VeloCloud orchestrator zero-day reported as exploited this year and it raises broader risk for teams that expose management consoles or reuse low‑privilege accounts, so preserve logs and file timestamps before remediation and verify post‑patch for lingering compromise.