Arista Networks released a security update to address an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments.
VCO is a management web page that helps administrators configure, monitor and manage VeloCloud SD-WANs (Software-Defined Wide Area Networks) and associated edge devices.
Follow up CVE-2026-114625This critical vulnerability could allow an attacker with basic privileges, access to the VCO web interface, and a valid authenticated session to escalate privileges via a low-complexity SQL attack that does not require user interaction.
“VeloCloud Orchestrator (VCO) on-prem has a security issue that could allow a remote attacker to access privileged internal workings and affect the VCO host. A successful exploit could compromise the confidentiality, integrity, and availability of the orchestra and data managed by the orchestra.” Arista said.
“On affected systems, authenticated users can gain operator privileges and masquerade as local ‘superuser operator’ users. This includes accessing functions intended for internal use only and not intended for remote access.”
The company says it has patched VCO deployments that host versions 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later.
Until patches are applied, Arista recommends that administrators monitor connections from known malicious IP addresses, restrict VCO web access to administrative networks, and review recent administrator activity for unusual changes.
Administrators are also advised to check VCO web access logs for suspicious activity, such as requests with unusual path components of URLs, encoded characters, references to local or internal services, and high request rates.
The company also warned its security team to block IP addresses 74(.)82.197.86 and 38.54.50.151, which were observed during the ongoing attacks.
“If a compromise is suspected, the operator should maintain VCO web access logs, backend application logs, system logs, database logs, and related file system time before fixing in case it is possible,” it noted, advising customers to contact the Arista Networks Technical Assistance Center (TAC) for additional assistance.
This year, Arista has fixed three more bugs that are not actively used (CVE-2026-7473 in May, CVE-2026-16812 in July, and CVE-2026-93952 in September) affecting the Extensible Operating System (EOS) and in the VeloCloud Orchestrator area.
Arista Networks is a Fortune 500 company and one of the largest US companies by revenue, with more than 10,000 customers worldwide.
Overall defense scores can hide what happens after initial access. When attackers are using valid credentials, defenses are greatly reduced.
The Blue Report 2026 measures defense technique by technique across 338 million simulations run in customer production environments.
