Networking solutions provider Arista Networks on Thursday rolled out patches for an exploited zero-day vulnerability in its centralized management tool VeloCloud Orchestrator (VCO).
The critical-severity security defect is tracked as CVE-2026-114625 (CVSS score of 9.9) and is described as a remotely exploitable SQL injection.
“VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host,” Arista notes in its advisory.
Successful exploitation could impact the confidentiality, integrity, and availability of both VCO and the data it manages.
“On an affected system, any authenticated user can gain operator privileges and masquerade as a local ‘superuser operator’ user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible,” the company says.
All VCO releases before versions 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected. Arista has already patched the hosted VCO deployments, but urges users to update their on-premises installations as soon as possible.
“This issue was detected by Arista and is known to be actively exploited,” the company says.
Arista notes that VCO deployments are exposed by default, and that attackers need access to the VCO web interface and a valid authenticated session, with the lowest built-in tenant role privileges.
“There is no configuration that can prevent the exposure,” the company notes.
Attacks have been observed originating from two IP addresses, 74.82.197.86 and 38.54.50.151. Administrators should block them, check logs for their presence, and investigate high-request rates, as well as requests with unusual URL-like path components, encoded characters, and references to local or internal services.
“If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible,” Arista notes.
Updating to a fixed VCO release is the recommended remediation action. Until the fixes are deployed, administrators should restrict access to the VCO interface, review recent admin activity, monitor for suspicious access, block outbound ports, and monitor for backdoor daemons and webshells.
CVE-2026-114625 is the third exploited zero-day vulnerability Arista patches in VCO in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September.
Related: Atlassian Patches 75 Flaws in Data Center and Server Products
Related: Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Related: Splunk, SolarWinds Release Fresh Security Updates
Related: Cisco Patches 34 Vulnerabilities Across Multiple Products
