Overview
- Arista released fixes and patched hosted tenants after disclosing CVE‑2026‑114625 on October 22, with fixed on‑prem builds 5.2.3.18, 6.1.3.10, and 6.4.2.12.
- The bug is a critical SQL‑injection that lets any authenticated user with the Enterprise Read Only role escalate to operator or superuser context and may let attackers affect the orchestrator host and managed data.
- Arista says the vulnerability is being actively exploited and named two IP addresses seen in attacks, 74.82.197.86 and 38.54.50.151, which defenders should block and hunt for in logs.
- Until upgrades are applied, administrators should restrict web access to trusted admin networks, monitor for unexpected outbound traffic and webshells, review recent admin changes, and preserve VCO web, app, system and database logs.
- This is the third VeloCloud Orchestrator zero‑day reported as exploited in about four months, leaving questions about which customers were hit, when attacks began, and whether patching evicts existing attacker access.